pax_global_header00006660000000000000000000000064132110365410014506gustar00rootroot0000000000000052 comment=f561e1427184eef90976d351a3a5aa113456343d nDPI-2.2/000077500000000000000000000000001321103654100121435ustar00rootroot00000000000000nDPI-2.2/.gitignore000066400000000000000000000011771321103654100141410ustar00rootroot00000000000000*.[oa] *~ *o.cmd *.lo *.obj *o.cmd *.ko *.swp *.in *.la .libs .dirstamp .autotools .cproject .project .settings stamp-h1 /configure /configure.ac /config.guess /config.h /config.h.in /config.sub /config.log /config.status /depcomp /install-sh /ltmain.sh /missing /Makefile /libndpi.pc /libtool /src/lib/Makefile /src/include/Makefile /example/ndpiReader /example/Makefile /aclocal.m4 /m4/libtool.m4 /m4/ltoptions.m4 /m4/ltsugar.m4 /m4/ltversion.m4 /m4/lt~obsolete.m4 /autom4te.cache/ /compile /example/.deps/ /src/lib/.deps/ /src/lib/protocols/.deps/ /src/lib/third_party/src/.deps/ /src/include/ndpi_define.h /test-driver /tests/Makefile nDPI-2.2/.travis.yml000066400000000000000000000021651321103654100142600ustar00rootroot00000000000000language: c os: - osx - linux compiler: - clang - gcc matrix: exclude: # osx use always clang for build... - os: osx compiler: gcc install: #macos - if [ "$TRAVIS_OS_NAME" == "osx" ]; then brew update; fi #linux - if [ "$TRAVIS_OS_NAME" == "linux" ]; then sudo apt-get update || true; fi - if [ "$TRAVIS_OS_NAME" == "linux" ]; then sudo apt-get install build-essential; fi - if [ "$TRAVIS_OS_NAME" == "linux" ]; then sudo apt-get install libpcap-dev libtool autoconf automake autogen; fi before_script: - ./autogen.sh # - lcov --directory . --zerocounters script: - ./configure - make after_script: - cd tests - ./do.sh #after_success: #- cd ${TRAVIS_BUILD_DIR} #- lcov --directory . --capture --output-file coverage.info # capture coverage info #- lcov --remove coverage.info 'tests/*' 'packages/*' 'm4/*' 'doc/*' --output-file coverage.info #- lcov --list coverage.info # debug before upload #- coveralls-lcov --repo-token ${COVERALLS_TOKEN} coverage.info # uploads to coveralls notifications: email: recipients: - packager@ntop.org on_success: never on_failure: always nDPI-2.2/CHANGELOG.md000066400000000000000000000053051321103654100137570ustar00rootroot00000000000000# CHANGELOG #### nDPI 2.2 (December 2017) ## Main New Features * Custom protocol categories to allow personalization of protocols-categories mappings * DHCP fingerprinting * HTTP User Agent discovery ## New Supported Protocols and Services * ICQ (instant messaging client) * YouTube Upload * LISP * SoundCloud * Sony PlayStation * Nintendo (switch) gaming protocol ## Improvements * Windows 10 detection from UA and indentation * Determine STUN flows that turn into RTP * Fixes for iQIYI and 1kxun * Android fingerprint * Added DHCP class identifier support ------------------------------------------------------------------------ #### nDPI 2.0 (May 2017) ## Main New Features * nDPI Wireshark plugin for Layer-7 protocol dissection. The plugin, available via an extcap interface, passes Wireshark the nDPI-detected protocols by adding an ethernet packet trailer that is then interpreted and displayed inside the Wireshark GUI. Readme: https://github.com/ntop/nDPI/blob/dev/wireshark/README.md ## New Supported Protocols and Services * STARTTLS * IMAPS * DNScrypt * QUIC (Quick UDP Internet Connections) * AMQP (Advanced Message Queueing Protocol) * Ookla (SpeedTest) * BJNP * AFP (Apple Filing Protocol) * SMPP (Short Message Peer-to-Peer) * VNC * OpenVPN * OpenDNS * RX protocol (used by AFS) * CoAP and MQTT (IoT specific protocols) * Cloudflare * Office 365 * OCS * MS Lync * Ubiquity AirControl 2 * HEP (Extensible Encapsulation Protocol) * WhatsApp Voice vs WhatsApp (chat, no voice) * Viber * Wechat * Github * Hotmail * Slack * Instagram * Snapchat * MPEG TS protocol * Twitch * KakaoTalk Voice and Chat * Meu * EAQ * iQIYI media service * Weibo * PPStream ## Improvements * SSH client/server version dissection * Improved SSL dissection * SSL server certificate detection * Added double tagging 802.1Q in dissection of vlan-tagged packets * Improved netBIOS dissection * Improved Skype detection * Improved Netflix traffic detection * Improved HTTP subprotocol matching * Implemented DHCP host name extraction * Updated Facebook detection by ip server ranges * Updated Twitter networks * Improved Microsoft detection * Enhanced Google detection * Improved BT-uTP protocol dissection * Added detection of Cisco datalink layer (Cisco hDLC and Cisco SLARP) #### Older releases #### 2014-03-21 * improved support for eDonkey/eMule/Kademlia * improved support for PPLive #### 2014-03-20 * code optimizations * consistency improvements * added support for new applications: Pando Media Booster * improved support for Steam * added support for new web services: Wikipedia, MSN, Amazon, eBay, CNN #### 2014-03-19 * added new protocols: FTP, code improvements #### 2014-03-17 * added new protocols: SOCKSv4, SOCKSv5, RTMP nDPI-2.2/COPYING000066400000000000000000000167251321103654100132110ustar00rootroot00000000000000 GNU LESSER GENERAL PUBLIC LICENSE Version 3, 29 June 2007 Copyright (C) 2007 Free Software Foundation, Inc. Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. This version of the GNU Lesser General Public License incorporates the terms and conditions of version 3 of the GNU General Public License, supplemented by the additional permissions listed below. 0. Additional Definitions. As used herein, "this License" refers to version 3 of the GNU Lesser General Public License, and the "GNU GPL" refers to version 3 of the GNU General Public License. "The Library" refers to a covered work governed by this License, other than an Application or a Combined Work as defined below. An "Application" is any work that makes use of an interface provided by the Library, but which is not otherwise based on the Library. Defining a subclass of a class defined by the Library is deemed a mode of using an interface provided by the Library. A "Combined Work" is a work produced by combining or linking an Application with the Library. The particular version of the Library with which the Combined Work was made is also called the "Linked Version". The "Minimal Corresponding Source" for a Combined Work means the Corresponding Source for the Combined Work, excluding any source code for portions of the Combined Work that, considered in isolation, are based on the Application, and not on the Linked Version. The "Corresponding Application Code" for a Combined Work means the object code and/or source code for the Application, including any data and utility programs needed for reproducing the Combined Work from the Application, but excluding the System Libraries of the Combined Work. 1. Exception to Section 3 of the GNU GPL. You may convey a covered work under sections 3 and 4 of this License without being bound by section 3 of the GNU GPL. 2. Conveying Modified Versions. If you modify a copy of the Library, and, in your modifications, a facility refers to a function or data to be supplied by an Application that uses the facility (other than as an argument passed when the facility is invoked), then you may convey a copy of the modified version: a) under this License, provided that you make a good faith effort to ensure that, in the event an Application does not supply the function or data, the facility still operates, and performs whatever part of its purpose remains meaningful, or b) under the GNU GPL, with none of the additional permissions of this License applicable to that copy. 3. Object Code Incorporating Material from Library Header Files. The object code form of an Application may incorporate material from a header file that is part of the Library. You may convey such object code under terms of your choice, provided that, if the incorporated material is not limited to numerical parameters, data structure layouts and accessors, or small macros, inline functions and templates (ten or fewer lines in length), you do both of the following: a) Give prominent notice with each copy of the object code that the Library is used in it and that the Library and its use are covered by this License. b) Accompany the object code with a copy of the GNU GPL and this license document. 4. Combined Works. You may convey a Combined Work under terms of your choice that, taken together, effectively do not restrict modification of the portions of the Library contained in the Combined Work and reverse engineering for debugging such modifications, if you also do each of the following: a) Give prominent notice with each copy of the Combined Work that the Library is used in it and that the Library and its use are covered by this License. b) Accompany the Combined Work with a copy of the GNU GPL and this license document. c) For a Combined Work that displays copyright notices during execution, include the copyright notice for the Library among these notices, as well as a reference directing the user to the copies of the GNU GPL and this license document. d) Do one of the following: 0) Convey the Minimal Corresponding Source under the terms of this License, and the Corresponding Application Code in a form suitable for, and under terms that permit, the user to recombine or relink the Application with a modified version of the Linked Version to produce a modified Combined Work, in the manner specified by section 6 of the GNU GPL for conveying Corresponding Source. 1) Use a suitable shared library mechanism for linking with the Library. A suitable mechanism is one that (a) uses at run time a copy of the Library already present on the user's computer system, and (b) will operate properly with a modified version of the Library that is interface-compatible with the Linked Version. e) Provide Installation Information, but only if you would otherwise be required to provide such information under section 6 of the GNU GPL, and only to the extent that such information is necessary to install and execute a modified version of the Combined Work produced by recombining or relinking the Application with a modified version of the Linked Version. (If you use option 4d0, the Installation Information must accompany the Minimal Corresponding Source and Corresponding Application Code. If you use option 4d1, you must provide the Installation Information in the manner specified by section 6 of the GNU GPL for conveying Corresponding Source.) 5. Combined Libraries. You may place library facilities that are a work based on the Library side by side in a single library together with other library facilities that are not Applications and are not covered by this License, and convey such a combined library under terms of your choice, if you do both of the following: a) Accompany the combined library with a copy of the same work based on the Library, uncombined with any other library facilities, conveyed under the terms of this License. b) Give prominent notice with the combined library that part of it is a work based on the Library, and explaining where to find the accompanying uncombined form of the same work. 6. Revised Versions of the GNU Lesser General Public License. The Free Software Foundation may publish revised and/or new versions of the GNU Lesser General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Library as you received it specifies that a certain numbered version of the GNU Lesser General Public License "or any later version" applies to it, you have the option of following the terms and conditions either of that published version or of any later version published by the Free Software Foundation. If the Library as you received it does not specify a version number of the GNU Lesser General Public License, you may choose any version of the GNU Lesser General Public License ever published by the Free Software Foundation. If the Library as you received it specifies that a proxy can decide whether future versions of the GNU Lesser General Public License shall apply, that proxy's public statement of acceptance of any version is permanent authorization for you to choose that version for the Library. nDPI-2.2/INSTALL000066400000000000000000000363321321103654100132030ustar00rootroot00000000000000Installation Instructions ************************* Copyright (C) 1994, 1995, 1996, 1999, 2000, 2001, 2002, 2004, 2005, 2006, 2007, 2008, 2009 Free Software Foundation, Inc. Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without warranty of any kind. Basic Installation ================== Briefly, the shell commands `./configure; make; make install' should configure, build, and install this package. The following more-detailed instructions are generic; see the `README' file for instructions specific to this package. Some packages provide this `INSTALL' file but do not implement all of the features documented below. The lack of an optional feature in a given package is not necessarily a bug. More recommendations for GNU packages can be found in *note Makefile Conventions: (standards)Makefile Conventions. The `configure' shell script attempts to guess correct values for various system-dependent variables used during compilation. It uses those values to create a `Makefile' in each directory of the package. It may also create one or more `.h' files containing system-dependent definitions. Finally, it creates a shell script `config.status' that you can run in the future to recreate the current configuration, and a file `config.log' containing compiler output (useful mainly for debugging `configure'). It can also use an optional file (typically called `config.cache' and enabled with `--cache-file=config.cache' or simply `-C') that saves the results of its tests to speed up reconfiguring. Caching is disabled by default to prevent problems with accidental use of stale cache files. If you need to do unusual things to compile the package, please try to figure out how `configure' could check whether to do them, and mail diffs or instructions to the address given in the `README' so they can be considered for the next release. If you are using the cache, and at some point `config.cache' contains results you don't want to keep, you may remove or edit it. The file `configure.ac' (or `configure.in') is used to create `configure' by a program called `autoconf'. You need `configure.ac' if you want to change it or regenerate `configure' using a newer version of `autoconf'. The simplest way to compile this package is: 1. `cd' to the directory containing the package's source code and type `./configure' to configure the package for your system. Running `configure' might take a while. While running, it prints some messages telling which features it is checking for. 2. Type `make' to compile the package. 3. Optionally, type `make check' to run any self-tests that come with the package, generally using the just-built uninstalled binaries. 4. Type `make install' to install the programs and any data files and documentation. When installing into a prefix owned by root, it is recommended that the package be configured and built as a regular user, and only the `make install' phase executed with root privileges. 5. Optionally, type `make installcheck' to repeat any self-tests, but this time using the binaries in their final installed location. This target does not install anything. Running this target as a regular user, particularly if the prior `make install' required root privileges, verifies that the installation completed correctly. 6. You can remove the program binaries and object files from the source code directory by typing `make clean'. To also remove the files that `configure' created (so you can compile the package for a different kind of computer), type `make distclean'. There is also a `make maintainer-clean' target, but that is intended mainly for the package's developers. If you use it, you may have to get all sorts of other programs in order to regenerate files that came with the distribution. 7. Often, you can also type `make uninstall' to remove the installed files again. In practice, not all packages have tested that uninstallation works correctly, even though it is required by the GNU Coding Standards. 8. Some packages, particularly those that use Automake, provide `make distcheck', which can by used by developers to test that all other targets like `make install' and `make uninstall' work correctly. This target is generally not run by end users. Compilers and Options ===================== Some systems require unusual options for compilation or linking that the `configure' script does not know about. Run `./configure --help' for details on some of the pertinent environment variables. You can give `configure' initial values for configuration parameters by setting variables in the command line or in the environment. Here is an example: ./configure CC=c99 CFLAGS=-g LIBS=-lposix *Note Defining Variables::, for more details. Compiling For Multiple Architectures ==================================== You can compile the package for more than one kind of computer at the same time, by placing the object files for each architecture in their own directory. To do this, you can use GNU `make'. `cd' to the directory where you want the object files and executables to go and run the `configure' script. `configure' automatically checks for the source code in the directory that `configure' is in and in `..'. This is known as a "VPATH" build. With a non-GNU `make', it is safer to compile the package for one architecture at a time in the source code directory. After you have installed the package for one architecture, use `make distclean' before reconfiguring for another architecture. On MacOS X 10.5 and later systems, you can create libraries and executables that work on multiple system types--known as "fat" or "universal" binaries--by specifying multiple `-arch' options to the compiler but only a single `-arch' option to the preprocessor. Like this: ./configure CC="gcc -arch i386 -arch x86_64 -arch ppc -arch ppc64" \ CXX="g++ -arch i386 -arch x86_64 -arch ppc -arch ppc64" \ CPP="gcc -E" CXXCPP="g++ -E" This is not guaranteed to produce working output in all cases, you may have to build one architecture at a time and combine the results using the `lipo' tool if you have problems. Installation Names ================== By default, `make install' installs the package's commands under `/usr/local/bin', include files under `/usr/local/include', etc. You can specify an installation prefix other than `/usr/local' by giving `configure' the option `--prefix=PREFIX', where PREFIX must be an absolute file name. You can specify separate installation prefixes for architecture-specific files and architecture-independent files. If you pass the option `--exec-prefix=PREFIX' to `configure', the package uses PREFIX as the prefix for installing programs and libraries. Documentation and other data files still use the regular prefix. In addition, if you use an unusual directory layout you can give options like `--bindir=DIR' to specify different values for particular kinds of files. Run `configure --help' for a list of the directories you can set and what kinds of files go in them. In general, the default for these options is expressed in terms of `${prefix}', so that specifying just `--prefix' will affect all of the other directory specifications that were not explicitly provided. The most portable way to affect installation locations is to pass the correct locations to `configure'; however, many packages provide one or both of the following shortcuts of passing variable assignments to the `make install' command line to change installation locations without having to reconfigure or recompile. The first method involves providing an override variable for each affected directory. For example, `make install prefix=/alternate/directory' will choose an alternate location for all directory configuration variables that were expressed in terms of `${prefix}'. Any directories that were specified during `configure', but not in terms of `${prefix}', must each be overridden at install time for the entire installation to be relocated. The approach of makefile variable overrides for each directory variable is required by the GNU Coding Standards, and ideally causes no recompilation. However, some platforms have known limitations with the semantics of shared libraries that end up requiring recompilation when using this method, particularly noticeable in packages that use GNU Libtool. The second method involves providing the `DESTDIR' variable. For example, `make install DESTDIR=/alternate/directory' will prepend `/alternate/directory' before all installation names. The approach of `DESTDIR' overrides is not required by the GNU Coding Standards, and does not work on platforms that have drive letters. On the other hand, it does better at avoiding recompilation issues, and works well even when some directory options were not specified in terms of `${prefix}' at `configure' time. Optional Features ================= If the package supports it, you can cause programs to be installed with an extra prefix or suffix on their names by giving `configure' the option `--program-prefix=PREFIX' or `--program-suffix=SUFFIX'. Some packages pay attention to `--enable-FEATURE' options to `configure', where FEATURE indicates an optional part of the package. They may also pay attention to `--with-PACKAGE' options, where PACKAGE is something like `gnu-as' or `x' (for the X Window System). The `README' should mention any `--enable-' and `--with-' options that the package recognizes. For packages that use the X Window System, `configure' can usually find the X include and library files automatically, but if it doesn't, you can use the `configure' options `--x-includes=DIR' and `--x-libraries=DIR' to specify their locations. Some packages offer the ability to configure how verbose the execution of `make' will be. For these packages, running `./configure --enable-silent-rules' sets the default to minimal output, which can be overridden with `make V=1'; while running `./configure --disable-silent-rules' sets the default to verbose, which can be overridden with `make V=0'. Particular systems ================== On HP-UX, the default C compiler is not ANSI C compatible. If GNU CC is not installed, it is recommended to use the following options in order to use an ANSI C compiler: ./configure CC="cc -Ae -D_XOPEN_SOURCE=500" and if that doesn't work, install pre-built binaries of GCC for HP-UX. On OSF/1 a.k.a. Tru64, some versions of the default C compiler cannot parse its `' header file. The option `-nodtk' can be used as a workaround. If GNU CC is not installed, it is therefore recommended to try ./configure CC="cc" and if that doesn't work, try ./configure CC="cc -nodtk" On Solaris, don't put `/usr/ucb' early in your `PATH'. This directory contains several dysfunctional programs; working variants of these programs are available in `/usr/bin'. So, if you need `/usr/ucb' in your `PATH', put it _after_ `/usr/bin'. On Haiku, software installed for all users goes in `/boot/common', not `/usr/local'. It is recommended to use the following options: ./configure --prefix=/boot/common Specifying the System Type ========================== There may be some features `configure' cannot figure out automatically, but needs to determine by the type of machine the package will run on. Usually, assuming the package is built to be run on the _same_ architectures, `configure' can figure that out, but if it prints a message saying it cannot guess the machine type, give it the `--build=TYPE' option. TYPE can either be a short name for the system type, such as `sun4', or a canonical name which has the form: CPU-COMPANY-SYSTEM where SYSTEM can have one of these forms: OS KERNEL-OS See the file `config.sub' for the possible values of each field. If `config.sub' isn't included in this package, then this package doesn't need to know the machine type. If you are _building_ compiler tools for cross-compiling, you should use the option `--target=TYPE' to select the type of system they will produce code for. If you want to _use_ a cross compiler, that generates code for a platform different from the build platform, you should specify the "host" platform (i.e., that on which the generated programs will eventually be run) with `--host=TYPE'. Sharing Defaults ================ If you want to set default values for `configure' scripts to share, you can create a site shell script called `config.site' that gives default values for variables like `CC', `cache_file', and `prefix'. `configure' looks for `PREFIX/share/config.site' if it exists, then `PREFIX/etc/config.site' if it exists. Or, you can set the `CONFIG_SITE' environment variable to the location of the site script. A warning: not all `configure' scripts look for a site script. Defining Variables ================== Variables not defined in a site shell script can be set in the environment passed to `configure'. However, some packages may run configure again during the build, and the customized values of these variables may be lost. In order to avoid this problem, you should set them in the `configure' command line, using `VAR=value'. For example: ./configure CC=/usr/local2/bin/gcc causes the specified `gcc' to be used as the C compiler (unless it is overridden in the site shell script). Unfortunately, this technique does not work for `CONFIG_SHELL' due to an Autoconf bug. Until the bug is fixed you can use this workaround: CONFIG_SHELL=/bin/bash /bin/bash ./configure CONFIG_SHELL=/bin/bash `configure' Invocation ====================== `configure' recognizes the following options to control how it operates. `--help' `-h' Print a summary of all of the options to `configure', and exit. `--help=short' `--help=recursive' Print a summary of the options unique to this package's `configure', and exit. The `short' variant lists options used only in the top level, while the `recursive' variant lists options also present in any nested packages. `--version' `-V' Print the version of Autoconf used to generate the `configure' script, and exit. `--cache-file=FILE' Enable the cache: use and save the results of the tests in FILE, traditionally `config.cache'. FILE defaults to `/dev/null' to disable caching. `--config-cache' `-C' Alias for `--cache-file=config.cache'. `--quiet' `--silent' `-q' Do not print messages saying which checks are being made. To suppress all normal output, redirect it to `/dev/null' (any error messages will still be shown). `--srcdir=DIR' Look for the package's source code in directory DIR. Usually `configure' can determine that directory automatically. `--prefix=DIR' Use DIR as the installation prefix. *note Installation Names:: for more details, including other options available for fine-tuning the installation locations. `--no-create' `-n' Run the configure checks, but stop before creating any output files. `configure' also accepts some other, not widely useful, options. Run `configure --help' for more details. nDPI-2.2/Makefile.am000066400000000000000000000002361321103654100142000ustar00rootroot00000000000000ACLOCAL_AMFLAGS = -I m4 SUBDIRS = src/lib example tests pkgconfigdir = $(libdir)/pkgconfig pkgconfig_DATA = libndpi.pc EXTRA_DIST = libndpi.sym autogen.sh nDPI-2.2/README.md000066400000000000000000000055211321103654100134250ustar00rootroot00000000000000![ntop][ntopng_logo] ![ntop][ntop_logo] # nDPI [![Build Status](https://travis-ci.org/ntop/nDPI.png?branch=dev)](https://travis-ci.org/ntop/nDPI) ## What is nDPI ? nDPI is an open source LGPLv3 library for deep-packet inspection. Based on OpenDPI it includes ntop extensions. We have tried to push them into the OpenDPI source tree but nobody answered emails so we have decided to create our own source tree ### How To Compile nDPI In order to compile this library do - ./autogen.sh - ./configure - make To run tests do additionally: - cd tests; ./do.sh Please note that the pre-requisites for compilation include: - GNU tools (autogen, automake, autoconf, libtool) - GNU C compiler (gcc) ### How To Add A New Protocol Dissector The entire procedure of adding new protocols in detail: 1. Add new protocol together with its unique ID to: src/include/ndpi_protocol_ids.h 2. Create a new protocol in: src/lib/protocols/ 3. Variables to be kept for the duration of the entire flow (as state variables) need to be placed in: src/include/ndpi_typedefs.h in ndpi_flow_tcp_struct (for TCP only), ndpi_flow_udp_struct (for UDP only), or ndpi_flow_struct (for both). 4. Add a new entry for the search function for the new protocol in: src/include/ndpi_protocols.h 5. Choose (do not change anything) a selection bitmask from: src/include/ndpi_define.h 6. Add a new entry in ndpi_set_protocol_detection_bitmask2 in: src/lib/ndpi_main.c 7. Set protocol default ports in ndpi_init_protocol_defaults in: src/lib/ndpi_main.c 8. Add the new protocol file to: src/lib/Makefile.am 9. ./autogen.sh 10. ./configure 11. make 12. make check ### How to use nDPI to Block Selected Traffic You can use nDPI to selectively block selected Internet traffic by embedding it onto an application (remember that nDPI us just a library). Both [ntopng](https://github.com/ntop/ntopng) and [nProbe cento](http://www.ntop.org/products/netflow/nprobe-cento/) can do this. ### DISCLAIMER While we do our best to detect network protocols, we cannot guarantee that our software is error free and 100% accurate in protocol detection. Please make sure that you respect the privacy of users and you have proper authorization to listen, capture and inspect network traffic. ### Creating A Source File Tar Ball If you want to distribute a source tar file of nDPI do: - make dist To ensure that a tar file includes all necessary files and to run tests on distribution do: - make distcheck [ntopng_logo]: https://camo.githubusercontent.com/0f789abcef232035c05e0d2e82afa3cc3be46485/687474703a2f2f7777772e6e746f702e6f72672f77702d636f6e74656e742f75706c6f6164732f323031312f30382f6e746f706e672d69636f6e2d313530783135302e706e67 [ntop_logo]: https://camo.githubusercontent.com/58e2a1ecfff62d8ecc9d74633bd1013f26e06cba/687474703a2f2f7777772e6e746f702e6f72672f77702d636f6e74656e742f75706c6f6164732f323031352f30352f6e746f702e706e67 nDPI-2.2/README.nDPI000066400000000000000000000011041321103654100136100ustar00rootroot00000000000000Prerequisites for Compilation ----------------------------- Prerequisites - GNU autotools/libtool - libpcap or PF_RING (optional but recommended) - apt-get install libjson-c-dev (for JSON support) On Ubuntu/Debian - apt-get install build-essential - apt-get install git autoconf automake autogen libpcap-dev libtool On Fedora/CentOS - yum groupinstall "Development tools" - yum install git autoconf automake autogen libpcap-devel libtool On MacOSX (using http://brew.sh) brew install autoconf automake libtool git On FreeBSD - pkg install autoconf automake libtool gmake git nDPI-2.2/README.protocols000066400000000000000000000020351321103654100150460ustar00rootroot00000000000000Tor --- Tor protocol can use SSL to hide itself. These are examples: TCP 37.128.208.46:9001 <-> 172.16.253.130:2078 [VLAN: 0][proto: 91/SSL][132 pkts/93834 bytes][SSL client: www.jwrpsthzrih.com] TCP 172.16.253.130:2021 <-> 75.147.140.249:443 [VLAN: 0][proto: 91/SSL][28 pkts/8053 bytes][SSL client: www.5akw23dx.com] TCP 172.16.253.130:2077 <-> 77.247.181.163:443 [VLAN: 0][proto: 91/SSL][136 pkts/94329 bytes][SSL client: www.fk4pprq42hsvl2wey.com] It can be detected by analyzing the SSL client certificate and checking the name that does not match to a real host in addition of being a bit weird. As doing DNS resolution is not a task for nDPI we let applications do and then recognize SSL-tunnelled connections. See http://www.netresec.com/?page=Blog&month=2013-04&post=Detecting-TOR-Communication-in-Network-Traffic For this reason nDPI uses a heuristic, non-DNS based, approach to detect tor communications. If possible, apps should validate the certificate using the DNS. This is not something nDPI can afford to do for performance reasons nDPI-2.2/autogen.sh000077500000000000000000000017551321103654100141540ustar00rootroot00000000000000#!/bin/sh NDPI_MAJOR="2" NDPI_MINOR="2" NDPI_PATCH="0" NDPI_VERSION_SHORT="$NDPI_MAJOR.$NDPI_MINOR.$NDPI_PATCH" /bin/rm -f configure config.h config.h.in src/lib/Makefile.in AUTOCONF=$(which autoconf) AUTOMAKE=$(which automake) LIBTOOL=$(which libtool) LIBTOOLIZE=$(which libtoolize) AUTORECONF=$(which autoreconf) if test -z $AUTOCONF; then echo "autoconf is missing: please install it and try again" exit fi if test -z $AUTOMAKE; then echo "automake is missing: please install it and try again" exit fi if test -z $LIBTOOL && test -z $LIBTOOLIZE ; then echo "libtool and libtoolize is missing: please install it and try again" exit fi if test -z $AUTORECONF; then echo "autoreconf is missing: please install it and try again" exit fi cat configure.seed | sed "s/@NDPI_MAJOR@/$NDPI_MAJOR/g" | sed "s/@NDPI_MINOR@/$NDPI_MINOR/g" | sed "s/@NDPI_PATCH@/$NDPI_PATCH/g" | sed "s/@NDPI_VERSION_SHORT@/$NDPI_VERSION_SHORT/g" > configure.ac autoreconf -ivf ./configure $* nDPI-2.2/configure.seed000066400000000000000000000074011321103654100147700ustar00rootroot00000000000000AC_INIT([libndpi], [@NDPI_VERSION_SHORT@]) AC_CONFIG_MACRO_DIR([m4]) AM_INIT_AUTOMAKE([foreign subdir-objects]) LT_INIT AC_PROG_CC AM_PROG_CC_C_O AX_PTHREAD NDPI_MAJOR="@NDPI_MAJOR@" NDPI_MINOR="@NDPI_MINOR@" NDPI_PATCH="@NDPI_PATCH@" AC_DEFINE_UNQUOTED(NDPI_MAJOR_RELEASE, "${NDPI_MAJOR}", [nDPI major release]) AC_DEFINE_UNQUOTED(NDPI_MINOR_RELEASE, "${NDPI_MINOR}", [nDPI minor release]) AC_DEFINE_UNQUOTED(NDPI_PATCH_LEVEL, "${NDPI_PATCH}", [nDPI patch level]) if test -d ".git"; then : GIT_TAG=`git log -1 --format=%h` GIT_DATE=`git log -1 --format=%cd` # # On CentOS 6 `git rev-list HEAD --count` does not work # # GIT_NUM=`git log --pretty=oneline | wc -l | tr -d '[[:space:]]'` GIT_RELEASE="${PACKAGE_VERSION}-${GIT_NUM}-${GIT_TAG}" else GIT_RELEASE="${PACKAGE_VERSION}" GIT_DATE=`date` fi AC_DEFINE_UNQUOTED(NDPI_GIT_RELEASE, "${GIT_RELEASE}", [GIT Release]) AC_DEFINE_UNQUOTED(NDPI_GIT_DATE, "${GIT_DATE}", [Last GIT change]) AC_CHECK_HEADERS([netinet/in.h stdint.h stdlib.h string.h unistd.h]) PCAP_HOME=$HOME/PF_RING/userland if test -d $PCAP_HOME; then : echo -n "" else PCAP_HOME=`pwd`/../../PF_RING/userland fi SHORT_MACHINE=`uname -m | cut -b1-3` if test $SHORT_MACHINE = "arm"; then LIBNUMA="" else AC_CHECK_LIB([numa], [numa_available], [LIBNUMA="-lnuma"]) fi if test -f $PCAP_HOME/libpcap/libpcap.a; then : echo "Using libpcap from $PCAP_HOME" PCAP_INC="-I $PCAP_HOME/libpcap" PCAP_LIB="$PCAP_HOME/libpcap/libpcap.a $PCAP_HOME/lib/libpfring.a $LIBNUMA `$PCAP_HOME/lib/pfring_config --libs`" AC_CHECK_LIB([rt], [clock_gettime], [PCAP_LIB="$PCAP_LIB -lrt"]) AC_CHECK_LIB([nl], [nl_handle_alloc], [PCAP_LIB="$PCAP_LIB -lnl"]) # The dlopen() function is in libdl on GLIBC-based systems # and in the C library for *BSD systems AC_CHECK_LIB([dl], [dlopen, dlsym], [DL_LIB="-ldl"], [AC_CHECK_LIB([c], [dlopen, dlsym], [DL_LIB="-lc"], [AC_MSG_ERROR([unable to find the dlopen(), dlsym() functions]) ]) ]) else AC_CHECK_LIB([pcap], [pcap_open_live], [PCAP_LIB="-lpcap"]) if test $ac_cv_lib_pcap_pcap_open_live = "no"; then : echo "" echo "ERROR: Missing libpcap(-dev) library required to compile the example application" echo "ERROR: Please install it and try again" exit fi fi dnl> https://github.com/json-c/json-c AC_ARG_ENABLE([json-c], AS_HELP_STRING([--disable-json-c], [Disable json-c support])) AS_IF([test "x$enable_json_c" != "xno"], [ PKG_CONFIG_PATH=/usr/local/share/pkgconfig:$PKG_CONFIG_PATH pkg-config --exists json-c AS_IF([test "$?" == "0"], [ CFLAGS="$CFLAGS $(pkg-config --cflags json-c)" LDFLAGS="$LDFLAGS $(pkg-config --libs json-c)" AC_CHECK_LIB(json-c, json_object_new_object, AC_DEFINE_UNQUOTED(HAVE_JSON_C, 1, [The JSON-C library is present])) ], [ JSONC_HOME="$HOME/json-c" if test -d "$JSONC_HOME"; then : CFLAGS="$CFLAGS -I $JSONC_HOME" LDFLAGS="$LDFLAGS $JSONC_HOME/.libs/libjson-c.a" AC_MSG_RESULT([Found json-c in $JSONC_HOME]) AC_DEFINE_UNQUOTED(HAVE_JSON_C, 1, [The JSON-C library is present]) fi ]) ]) AC_CHECK_LIB(pthread, pthread_setaffinity_np, AC_DEFINE_UNQUOTED(HAVE_PTHREAD_SETAFFINITY_NP, 1, [libc has pthread_setaffinity_np])) AC_CONFIG_FILES([Makefile src/lib/Makefile example/Makefile tests/Makefile libndpi.pc src/include/ndpi_define.h]) AC_CONFIG_HEADERS(config.h) AC_SUBST(GIT_RELEASE) AC_SUBST(NDPI_MAJOR) AC_SUBST(NDPI_MINOR) AC_SUBST(NDPI_PATCH) AC_SUBST(SVN_DATE) AC_SUBST(JSON_C_LIB) AC_SUBST(PCAP_INC) AC_SUBST(PCAP_LIB) AC_SUBST(DL_LIB) AC_SUBST(HAVE_PTHREAD_SETAFFINITY_NP) AC_OUTPUT nDPI-2.2/doc/000077500000000000000000000000001321103654100127105ustar00rootroot00000000000000nDPI-2.2/doc/nDPI_QuickStartGuide.pages000066400000000000000000003736321321103654100176710ustar00rootroot00000000000000PK!]OIY1UUIndex/Document.iwa Uf;7N**"2:z3 "en_IT:J Pen"*2@bpDRDBB̍BB?HP_LaserJet_M1120n_MFPiso-a4 %7hXT> )Xd* 80*ٴAF&&(MA:&L(+_A:& &<:A *٥ RnDPI - Quick Start Guide Open and Extensible LGPLv3 Deep Packet Inspection Library \ Vers$T1.86 JulyOctober 20165)© 1- TaXof Contents 1. Introdup 4 1.1 Download Source 4 2.  5 2) Compiling  / Code"2 "Hthe demo pcapReaderB13  Comm!A,Line OptionsX4 Protocol File 6 3. Examples 8 3.1 Live Capture Mode2 c B3>U9 4. API4 10 5. Developcustom p  13 5!2V! reat;ew:3(3 Add your to {5 : Ixis a AliE;$ based on A~!@currently maintained by ntop. In orderpprovide@ a cross-platformiexperience, we also support Windows, in additA`to Unix/Linux. Furthermor A0have modified2make it ' suitEHfor traffic monitor!NapplicaE.We S0achieved thisdisabEspeciDpfeatures that are unnecessarynnetworkJv,A rebyOedup )'ngine. -allows.(-layer detee{ of!}E0s, regardlessa;%bbeised. T mean itAposkto both b knownbA#,non-standard_s (e.g.3 HTTP(zs o!!*n 80),EY%opposite6ASkype5<onJ> !4ecause nowaday e conceptpAX=.9P no longer holds. OvA(he past fewAthsAE`0added several9inclu!,: EnhancemenwM ndpi]g)Zin term%speed/UQavencapsulIq% ed (Ain!{cijca8w analyse GTP tAllAI$). Ability!cozei2insaeg$ kernel so!ted!jitEdeaQi 7-E ./,gen.sh ./con ! AO Ž!j!x>i*F M^*Ma7ay ~duE\vB:/eb 3 N  T *.K! |rW nN`eg(particular,7is2  $y a lot of!mRYoh . avail}  a minimal lanJ each *P lisbelow: =L-i [-f0ter>][-s ] [-p <s'l ] [-wve j $ Usage: .az| SJ !J /playf pas~ortslca(x-separa!8H)f mexpa of: "  Ca ion. B ra  dl8s!)e over) exisi. 2  . dM flag e%a6l . t%Jdits.u he" *fa}. m| Usa,., genewsqU fEX. Auns per>.Ֆ lowl Jdis$ QK ‘B,ыakis<. UDP 62.101.93h:53 > 192.168.1.132:56130 [%j: 5/DNS][2 pkts/260 bytes][chat.stackA flow] TCP>R932h{(61.94.220:8e7/?][8 f 1925g]682^58Odiy exchange 916Zd524d,conjugator.r$so.net] .NWbWB U"_ A1 s: R0d7995 > 157.55.133.142:1235Y40/U][3I7205M65@(223.47:3303A: 79975UM5471 U$127.23.238a5`:16384 > 240.199.103.219:R11 1611vW0JS kqW273U]2BhaSa&%B&< 6Dsf./iM;(ge, WhatsApC? X(S)Xɺec&{ ho  IHost:” decito embedR ran &drob popN$ Aho-Coras algorithmA hund $ ous!= is{ly (i.e.2 enoughsus10 Gbit"f on ,(ty hardwareYRlyocols at time Eat }r&tf # SubN  Form !(:"",:@ "(googlesynda"@G&vᔥ$"@Veneer .]ABav -j2, :, $ tcp:81, 81@H udp:5061-5062@SI$60,32  @iSCSI U3000@ 5 rsY# )*( -p)2wor V.M N_ _U_A4()iK. *Tf %,we show some.cas= VCYP cP modeame -iek!9 a +.+2f* . $ ./<-i eth0 -s 20 - * NOTE:Sisapp!Y*!Z*). * I1w-, ly)b= * jto%jA& wdqtdo90. Feel * frece"d!X send Xe[r#--7($R[$: #### $) !(%M!...+&u%q20A pcaa P : 2390of1!$ total IP<1 17757430 d ique`  78  throughout: 122.30 pps / 709.92 Kb/sec G(lo&"s:  De ed) DNSt2 : 57.R : 7904v s: 26$SSL_No_Cer*pW48- W22920 W6" $ FaceBook  W13./ W74702 ) W!DropBox!W9 W66.  +!:W52 33.nVWO2> W170= W61913qW 4 3EiCe T%m  wa $eu"otcpdumpa\B7 top$4-nW40 -w /var/tmp/ -v e:Genaon en1,k-t"(EN10MB (Eth4!t),? size 6553 Got 06475 6 ^C1221ZBd .recei$byw ter 02dropp !!9A been )]0& willB to launch:do'ݑ i:NVV Aэ#ɿY)Rӊ 49112of iR332154*>14NAn(.612.80 KͲ3.09 Gz.bM :6/76 =zRW615 W2= = v.253`84?0 W7.Z z^152WU8 W1%+$B.FW164^!v6Qc-20121=-!(:2MW87=Wg3 2, &<larifys aSY &enow goaxpl# v "!%CO! .orgFP %$cu.*do by edi& . J$ echo '\"@nTop'> 1.2ըpRen1a 30 K o o o o o o n1V E*n 3*n WARNING: IPv4/IPv6qeD (z sl#AE,llQQ$discarded D75D757TRD176637f>D26DGZ NV v2 92us:6* z32516 W. 6=fW983 W2jSDnm.-W95. W1.m6h3.W25.iW.* zt2W489W6zt1.W92 2) zt2"( M 61279 W2v ~325\40.W6VW3 .3 R-1e7,is highlight N'0taken a]U*itialpr"NI*Rtoa8?+d+perlyv)d Makel_ToU,r&&,of 9i,r .*-Ta*34X1 es - w))ad-e* + : #" _main.h" e-b*15d@9+ Dex !bitmask%*i ;")m0X NDPI_PROTOCOL_BITMASK";( _struct =]_O_ ion_ E( ,ticks_resolu$ , m.,c_wrapper, 3debug_ f);!is fun/IgB]DZ!g eldsIF)5tI4@ings: u_int32_t per_s';
 ANstamp% pera:ond (ke 1000K milli D14). void* (*__-(lloc)(unsig63) }F1po'a memory%c :X!])( prtrM%z!1r, NULLAp39$ve environN4 EnJQ|s (notAaEe (se'!4ife>) via(appropriate-roE< themqEUyM. //rllf EBI0_SET_ALL(all)Qet_]mN2(%i, & 9 w&1:J u al&y"$yZ"l >$]%LsPY: dpV2)y: Patha Y/7W& gr)q%a-z R1 =<,nsty)U 8_2( .1 D,iph ? (uint8_t *):2f, ip, ,, src, dst!"fkI9FA  * *_.U2M 4 * :F.?A &$5 iah9 !Ychar *)G U 6)Ai length of 3len *bIL/:3 (IP he==>c)sh/9 len P.le eV +. H2<Ÿ  ).I2id5src VoiB}J2subscri-st6)I(Vds NVde(f[mA'eesedD1&<8estro>k".nEexiJ> ,N`>`*)V k)ABtou clear iF(i^ _ *ptrr_45 . fur in" < uggG)to,%iG*$/Y *~.c,$?/src/W  s.h^!public_1 s.h K% c.d*orr/q?3_5s&>5. d@b2 !!J h"~ {(< . B@ Each is .0 a4 ent#? I4*n$c@ DPI.EQ  es =!at 5as"1 h4ctivity,low:'3E!!r>>67X/R 47o&  . 5RA-#, . rrespon#l-1w!1A nS7E. /I~,s_osdpi.h aJ!8 w " MY , 171 wheref&!m “name4=171B#ID'm:"! ?2N"$)%d89 ax(&!0 l^ 6libyh/my5: .c 9aentButils#ifdeff6S  & #endif1git be>Hf<>Sah  earch_( !jG , 64. ) { 2v*%  = &<->  ; ) LOG(b, ,1$_DEBUG, "m&=و...\n"4 /* skip mark"Cchecki2?]H. */ %( =->)8e&&_)[0] != NL) !* O ~2.!+$); } } aDa corUpr LaFCaPJ= icF  & 2y , 23' A12 $ B0 &v pay _ = A[  CEg{/ < if(“Found P”! i N 4U ` ]M Iint._add_&` R0 return; }6 /*ExDe*/ !  “e cF kADDYTO. ( !-> B};h R;y b)ic" are4Ec]ctGaa ( B z663!U ,MKdue_to_l a6 i~),a@%NO/*Cho7!t$of6 */e H CORRELATE9d REALi);!5bJN.d):[ 7    /:9  r/*. */Bz@ U# be assoc da) SELECTIONq ful@B=1B)  2 o g  Afm-cAA> & %*   K2*d  ] 3  >K22e" oYV~6 2-j eB * dbm)}   v -") 2 1,a X6*{ .%-*> .#HB^QSAVE_DET6$_AS_UNKNOW.ZTOF.aq a UpJ0$back_buffedex  a++;" )l.i ->:H_> = aF Nv/ "R_is %u\n"2AV^*                  (b cf d e if g h i j k l m n o p q r s t u v     #$U      < Fd Z Z# 7    Un   (  (     - P P    iX- P<    ( 2 7  < > >? ?2? @ @Z@7BBqM ! }#E #  D  7D E F G H IA(J K HL M M M   N O PA P P< PQP PQafR S T U VWa(X Y Z [A[ [1\1 ] (] ] #^a/^ _e` a b ca>daeaff(g h (i jj$k k     ek 2ms n!n n (o oZ e9 opp  p p-q2rst # du du v<w< <w #x# #y z;z 2)z{ |} ~1Y        ,0 ܁   );Rn   h'' ' ''' ԇ""> """|33((ڊ((((!//FFÌFČ]Ў  SSj.$$E 9ϙЙE A ךu ??AW""E aL e! , SSà 35 mG<2 : VMDMs k .M  d   Z  Z  (  Pu  a k (R (\ F\ 2\ 2W FW "  P               /  l l S : 5   < %, !   !m 2m m Zm %m ; E (E dE ( Z x 2   <    n %    <  (  (  <  <  (  (   o j L L L  L L A ; !/ !B!!,y,,|4(uo!!ɶɟɟ!ɟ!ɟɟ,ɟɟ,ə B$סA_ W W##aT 2 ( ($    F   ( (  (( 2     o!JZ<~2"y-!  P b# -~gX S N 0 ~~t(  01N  2Ŧ%,92;( %@  !!ED%D"%ū#! N ɜ%Q<2Ń2  ō(A^ #j  %Ű_ŰejŃV(VuA?$2"xw y < ϩ2nCyC   ==N"HY 1 B || ' s !B dJ  ,PZO  AJlLN3 0E ; I ;b  r" z fA 7 8 + e   pq  ;   )  )1 k!} !R%%CRR 5I pw ( &4C4E5785-DD63-4E9D-8ED5-EEB96EB10D16_9K(e8://en.wikipediaA/0/Aho%E2%80%93Ring_mL " R Pq8*xq x1A"$FE82A637-0F28-4FCA-B2DD-E15E71814F9166rqL&wL $N rX9"  * Chapter 1OrD*   "\r c* (.JPq*Q*$B PyL]{>* y_J_ZTT(Y* X]J]JZs.  M4 2>!4:4B0+A*w  %  u u 8  #    ' !   1  (u  ( i6:6 :@::::`: : :::2P 6;(118B8:TuNfh:Thh!2wNjJTBT:4(A* A*H 2efN32I.O]>OFOUI>!:BS ~8S D1bookmark H MH3! code.g1[=[/p/opeU) /] ,]1B n  z- 66B9AC32-1E30-4C8B-9BD5-035706099A1B7$multifast.6forge}a /j ( A577E998-BEC4-4CBD-AFA5-6E9C82FA83F5Wd & $38125E95-07C8-450A-8FD9-A3E502E62AD9:!^Oq$/blob/dev/N:j ,F / E7EE46FB-D411-44D7-8614-22C282258C54!iQ9,3 OLE_LINK2AF % * 2435AE66-A550-4DC5-B158-EB2DB538EC38 *, -FsUq + sD0F0BA05-3D95-4515-AB97-C13E8BD8B254FL <. L6216BFDF-D3F4-481A-9EB6-CED5CDA37E85jL &, LA6DC166B-9A31-4D14-939B-F122EFBEE51FjLJM1213C751-ACE3-4375-8F44-790B1FD86401FN50 "$B10AD2Lp7E5-4ADE-9D91-B5344CC0B9F07 T * " ^ *2 9  fjC4{FB dR?%?-?5?`0??%??-?24>%>->.4$>%>- .ear 0]>%43?-3_20>%>?-.+J20X>%>-"20H=%>-20?%>b?-β20>%#A?-8`20>%.?-0u20>%t?-2!] %=a?-20'r?%ԉQ?-ʐB24\c?%z8?-M;.8 G?%?JR(?%@?-2N*?-Pj20Xm?%?-924DR?%\>-Ч=.N<>-^24 d3>-x20UO?% >-,20.?%=-2h0?%>-820P>%v>-20>%h=-2h0p>%p!=-~0 ^\$ a,F>%-3?-ܹU|AA? &RTU?&% *˖@2`RtF`NL`%>lB`RD`>JB`R<`>BB`R4`RTB`R,^`$"A>hK=%+ ?-/?5L?`2@&4 G>%-?-=>^&4u?%6^?-\=^&%@Nr UQ?%;=4Z0|>%X >-:6/eaBB@ `?^z141 @ 1 bA 1b1@ 6~]p*? -!T(08R y818i8(>;rpR - 8J 1>%a=3A .=>% ""*2RB36  !2!b:7 :: #         K0AV  ! (>9'F *,D"aPa7!2X:C.Kc67@(. H*% 0 T9*AA*x:BJRZ`6x!#x t$:vvvvvvvv`>>x!#<"* 2     L:cTRG5 ʮ ->>      L:zk%I݆K >>!!L:cBLΑiMbM :!L#64a=Qy5a5!C(BJu5`>>9!9!9!4!9! ! L:MSAvKU~c-9>>L:\T:L+(v :%:3҅('偽ف!!ҁ!!5`:xx'"3z(Ux7zzAx77z`:zz#68#vvvvv`: vX:& !<]2A@ *  PK!]OIFIndex/ViewState.iwa* O *   t  * [= * 08,B  J03y@ $@"8"   " <* -0: DUDHPX`hp}?,CgC <}DD%TPMacInspectorSegmentIdentifierFormatA,4 Q :  < @ PK]OI9Index/CalculationEngine.iwaL* h Ÿ (ץ"* " *:2" BJj\ۓ (jFjT֎҇ ί(j>jdg ׽* (:iTa̞ (i:i`l Ѿ9 (ii:UX (ֱ 6 b Z ^ ^ ^ Z ^  *en_IT0`:I:0AR Europe/RomeD*  bB. BE* >  A CXB%%@A-/0(8$JE Y{*8 $511F3907-868E-4C33-B720-0F94B217D5FE"`  `"*28@J RZbp08BTable 1p1@ _@333P@!Id^]T f T 0M b(% 1 ,H8*""**222:: $  ^<]YQ !%-85?`? @2'E /4: .mmmZmmm.mGvG.mGrG.m ^.m ^Fm^Fm^.mv>Z; $  ֓ x̃꿐"̛⹆9"׭Jc"΋l(((000 0 (ءZk PKIFt77&Index/Tables/HeaderStorageBucket-1.iwa39 .) A  . $A PK]OIݰAAIndex/Tables/DataList-1.iwa==.%* "  0 "PKIFiIndex/Tables/DataList-8.iwaL .PK]OImYIndex/Tables/Tile.iwa  .  *0  : "(A<^<A(N<<<<<<<<<E<08v2x >AT0PKIF=)Index/Tables/DataList-7.iwaL . PKIFFdIndex/Tables/DataList-10.iwaL . PK]OIH<<Index/Tables/DataList-3.iwa86 .& nDPI License LGPLv3PKIFZ9P22$Index/Tables/HeaderStorageBucket.iwa., . 0B  C PK]OI6W;Index/Tables/DataList-4.iwa.0* J J  (0 Jd *   W* www.ntop.org* 2 : B Pr" :.S $nDPI web*k:.T> ! site:5(x*1"http://.8/products/ndpi/~PZ1`R  I8N ( &F2CC8816-020F-4A72-90E6-7E0FAADD7B36_0"PKIF&Index/Tables/DataList-9.iwaL . PKIFp^%%Index/Tables/DataList-5.iwa!x . 2PKIFyjIndex/Tables/DataList-6.iwaL .PKIF*3Index/Tables/DataList-2.iwaL .PK]OI)vmm!Index/AnnotationAuthorStorage.iwai` #  8 ! 3$2"    Annamaria Tirinnanzi>%>-0>5?` !T( K2T( virtualwinJ8`>%>- ?5J.0JJDFilippo Fontanell 0>%P>-;.R.R.JR<Francalacci Yur P4=?%>-='JP Luca De I0z?%o?-.5ق %;b.P$JTuxPatF%!4-@>5?` PK]OI!Index/DocumentStylesheet-2211.iwaA_*                  P-   #( -2-  #   -K#(--- ## A77P(#<  (  K (K2  # A!2KA FU (s !1 -_ (# A( < -K#2 <((d(  277 #  (-< <(2 dU(U 2-<# F2 #}#n 2  x  K  -F(ZA7-   Fd ( 2  (UKFAU(K -((#   sPK(- ( 7!" 2(   2x list-style-29 tab-St chart-0-series_34464 paragraphj$5 b(Name-4-shapn nB_ !2-72>7473B 822|.E!/1./! 27>3~ D-5-valueaxis_1=43. 5a-39L5>L!:5-head23:R3Z>a3>0BF6!71>7n$ . Column11:=^51^Bq )84-referenceLine6>L 6acter-null>1a%3>318Ae>1A>y2a&64FR4>T1T,stickyCommen^. BDY4>!Rt }!+BafBPAq0NBa>mIp>.%image-0-Q6-26B!>]2linF% FAxt-4j:0m5:hA 46i=11}-0J-՘!dBzaF>z!_=BL>L1a.hB!!BtRLk>!݀կ9"ՙB! 5= automagica ,4-bodyQ˽$.!9-.@@շ3.Y:#1!3e'>B1:p0IB 5RP4!&VB!B;!hcedefaula>AuyBryB%J%>Q318363m6j>C>BA_]BE movi1dB*]<26<O-46>j:6]zA7>ZN!N=:Bi!:1DBeE>318 " tocB]BR4!/& 5Ja ś& ћ6026c 36R % >5:z2F BR5!=TB4!]B]]" !Rv3!n-A!P $5-category| ! . 0hyperlink1J3B6320Fn>R4 >t >[B=+!5R4!t3FetextboxUhapu3BwRx0 nw<p>x>=318!`c )E1"I N2iq`B<:Y 2F>X' kSFWPFootnoteTextsHIdentifier( !v }ƙ16D*0ɒ*aB ݍ"w 3%XB3S]1FX]" SS9 -16&}n!!f36f}2%F<56<a* rB#!:M5FM>EV !5^ : 6La.* 4:B!BA5*4 2:^61 R&Vn RQ*f0:{b !t6E 2 6K60F W0-5-legendRB6=jBZ!*i "=!N >ABh16:/E 0360aJ̕ M56MV:K>4=B $$>S*B%!e>!=;B@*.aN 휥0Y4Y& 2J ō  & .RJᝁ.7}5"qn A!BN!w ex) -Non!*B`e>9V39V]2"? 5:54tRne]>/&y"44: 22 rB:%6%=BC=R*4a( 16 =B)W%E <36<NA&N M56M:3FZc AR >Yu2YuٕK% BKar 55 5R:5U6B][B|=BxBR~3AR8:52VS=V19Vn1!BC>4Rݥt-?=3BRq*= a,V4!:( QB/62 X >953%]ڕ14&*0G>,ERn2"]B:":B!.AX]0YR5!*`Br*3J>*=y1B>eE>&q>4&>g R3!BA] B!>r7BAXmZns>s R: i :V>G>>j}>Ge612>fBeA eű-06a>318>N=B *   "*    7    *F :    `o)A<Z * J .* *_  Z-   )  *AX!$I!$  !;   $A< 83.* Av *PZPA*VAGRoundedLt-NormalbB(* ! H$1B%7 X3ZA* HelveticaNeue:%- X5?`Jen_USPX`hu} 3  ,Hbc,%B(=I@HP] $jpx O sd]@A -q=* !q1qe]8eUU?eUUU@e@,Ae Ae:AAA{ Q " +RB)}X>vgv l&vHqiAmr !%4& U (B0)4ZE PA* Uf@RbI7֪$b`.RE.D*EQZ2  4q]>?%@?-U-@?q A% X C !*)>) Z @SSSS@S]6S>S6 0F>%-3?-ܹ_fm 3 %*ݩ3ݵ3ZbCXB?BU,* ' , ing 1 A AF29 3ZQJ.j.bN...*52. }F)61)1)8@A* Times-Romanf+n+YzYe]g*eqZQ@A%$?%?-m/eϡB{d4B8? ->08bO 9L* ) Free Form^ 11 A*%New% PSMTRJ__noneR~z!@@pAN > *P(*#){ZfN*N) 'S 0"(1J4 6 *t  @@L*8 "Qr?  @2'ai)e.N*SFS<2  Wood :  B  J  R  Z4>%ߐ>-N> bjjjr 0>%?-Tz RpjnD  4zC  -?22vBd222 @@ z24B -LpIX>% -X1!. R% T?%C -dT TR;BT bT@.T T!KP1P Tbʤ~T T. TjR Rq AI 1 RWn MBWx"Iܖ8 TRa4 T. T.)P^T!  v? @ Ax 0N?%#?-CΘx$&b Bn6~9 P"nRfn!z3 4d3 3 3 3 3 63 63 63 63 3 06>%>-NQp3 R3 R3 0>%t>-T3 R83 R3 R3 3 3 3 3 3 3 3 R27 3 bT3 n3 b2 3 bT3 n3 b23 Rq3 3 3 3 3 Ra43 n3 .3 ^TΛ 3 .3 0Q ?%q?-Z& ʔN3 "3 *n4Z@Z"v ˯B?\ 7E7 H} 0B7 Y  "NU\   BA-&&&"&" &&&&f&4  Fun :  B  J  R" L1?%>-">5333?` R R R8 R R Rj !bT6 n b2 bT n b2A Rq  Ra4 n . ^TV . 0d?%>-3Q R >&"#% $2N$3 $* #n#_V*$&$#779+;# & Plain 4A1F/21,$ 4 A*CourierNewz5#&j&$z$4#D+ /*D+ ,Z0AR,  0 C# !5+H .? null%n2&H*nM4Z=H*"0*0*j0*R&:)5::;%S~~$S0&2)*>&Z5B@+R&@b  A  `B    C( D uF ` |    p+ &H/aAe 8Ae@BeB.*(R((]$@b$* [ @L8 er + (Latin) Century Schoolbook 14 pt + Not BoldF% P3Z08`A* LucidaGrand00*6*:0''0$ @e$@e۶ ( Aem+Ae۶M!pAAW.jBC8W,jjjjnj.D D*-"-ZRfb XC C}`# ! .IeN63823,,:,yV! 43:*%*NJ3; pX 2**L)9& t!Be#f 5.63XX6Q3ej? 0ff@e,Aefffa(Ae̬AeO3b b•YVB>5)3rRS&w50  List 6.=1PE"A&q5!m6 mCm4X|Cc5c56p8·ov8>XWώ@eWAe7VAeUώAe/AeABt<9  %3123MX>#xx x.^mARI482I5^JVzB@!=2e23Dzc(c(c(c(c(c(6c(6c(6c(6c(c(06,?%޳>-X(c(RuN8u0-@Tc(R8"uNU"uNuuuuuuuuNj W!"u^TEuru^2u^Turu^2A uuNquuuuuNa4uru"uZTuuu,i_?%X>-۽ou*u&2J &N=& &` AI&f)RfFB|G ?ep4RpAH" A5*"ZJb F@iSHy m@ey @e1Aew mAe%AeDZAeJhAe| A,*  Q.L[Z [o=0Dl?%P>-f]%@ (o=$:Chalk2"rO5;@)08*PZ2Fd>.iDR K&4I,JXZXHH-Light/Al&p R(6(((((2(2(2(2(k 4X>%\>-}!?6(Rk Rk 08>%>- _-k R8k Rk R*k ??????.?L(v>%>->5Y?`6  ?Rs k bT; k nk b2P4bTk nk b2A k k Rqk k k k k Ra4k nk .k ^Tk k 0*>%6$?-ҰTk Rk I3 w Od3Y \  H c&%l* . Termine definizi:aFy#E3 P3Z&@~KI(GB}KR}KfY "Y BScN9w9ED* - ElencozDEDDDA"TAT^Dq&*-&-&6 z-&3F-&A-&-&-&-&4 ?M b2*b}PZz76:urQTB@ _8D9[&G.JGZRB%_oV@B&@"""""_9; mk~aEA? De;w Fill)er'Y+L?W?Ao%"R->nG1 8@J 7, ApAAhLL Directional Key @?fR4(GdH  %R LB5x Lef =f-:( Medium  Top bR?23:A3@A3ȁE %,er Highbht?hGk&6 BodyF{330 3Zig?#Z#>Z>5'c;4S0AeSAe>B8Be~h\Be>Be%IB.;=@ ' !u<@ 2N>@%kh@kkkk78ֆ"$$&$.  PZ$0>%P|>-!$N$Exzc$ic$c$c$c$c$2c$2c$2c$2c$c$0&N?%2?-E0Rc$Rc$$g?%!?-6Y^c$R8c$Rc$R*c$dcdcdcdcdcdcdcdcR0bT8c$nc$b2-c$bTc$nc$b2A CMRqc$c$c$c$c$Ra4c$nc$.c$^Td CM.CM %]?- N1Y&0|R3423D}=}=}=}=^}=.&D:d>R &+D0>%.?-0u` btz&7*Bq Z;+B42Jj2v0b]T J`B   C( D ` |   C2Mz&2jJD¹B$ADBXB B C*21*K:2@>N b؊y>  C3./t<<<<f<(x:<[(><$>%>-  f< r5s l2{.\2"%>-"? 4RRnxuR8RRR2`sbTnb2bTnb2RqRa4n.^T0W>%f$?-VRE&J1,RJ1ON&?2*?2. Ze cA^ yBA!sf aWd (*f"f ZJ0A @Ҋ&r\:k^0V>?%@?-&@n.W_( .| Jn2*W @TD@`7B`7T YN3ZCEZ_2rZ$VVVVnV3&G$* * $er & ZF3"5""# A*7^$$oV$yZ BnZ NoZIݚ`H fff@YM&*"NI f( Green":FnFnF  RF&oRRRnzR8RRR4 bTʈ nb2bTnb2A RqRa4n.^T?!.!0q?%b?-}*&z_&NiZ>(0i<JlP Zb1V'A5>0+ + + + n+ .z.m4>OK-.m0  &" %JZS8b   C&%#N\39N\3"I\3\3\3n\3N\3.1Os *Os1NOs.OsvEbZbOs>Os24 V NK2KK rH & LfvZ:IXàut<*Aj&XZ2Cob]3*%PR!q%WX&q%ePAa%&&&jƞ>L@e>@ep_Ae:LAeAep_AeUAe?A`q72BLai*`Ib2

Z .rq"&:*iz& .1r&LRS[ 666662626262660ˇL?%ЎL?-ʅLS$R$R$0>%?- 6R8$R$R$$$$$$$$R16bT$n$b2$bT$n$b2A $$Rq$$$$$Ra4$n$.$^T$$0<?%?-$*$&6& @D%z%= 4Z*FD "nEvJZJDj5ޭօE cZB.L- HTML PreformattedJ$3p P32X:&5$v!"!(  337B ff C 7 e ff L 33   f f DQ L + 337DR|:%ɺR1&I7]8 Numbered List.P7tNVJUUΰ|386|zx>^Oy ("c4(*2 )sb-1B6( Z $"k8 G>%-?-=>5`2@u4Ju4)v 7T @ [0*P Z#" Z4R9*HBulletFp>J>J>J~>J9]}:-!.-V:@knڄ. 0^BV^4LLLy|&&ō7 AJ;"B;+www:ƍd +)a.  Z(]/0o?%o?-oa,>%$"?-"ڍ )S.SMS.S ?/ , @0&+("W0>%>-5+ʷV{L>?L>'5T.T T.TWT.TDbT2W  bTʤWT.T. T.TJTTJTҞTE(4@2'%bQ %- 5?`B> T T4>%>->T T X:*  *PZ  A*TimesNewRomanPSMTJ__noneb ' PT chart-3-series_2V< 6  % @4@@L*line8"z?*SFST2 Blue Paper :B  BB  JB  RB ZETt;>%>->5Y?`bjjjr 0g?%!?-tQz RpjnL aD/AkNAC6 aY?0822d222 @@ z24B -LpIX>% -X1!.e~R T?%C-?T TR;BRbT@.T T!KP1P TbP~T T. TjR Rq AI M RWn MBWx8 TRa4 T0f T.)P^T!  v? @ Ax> 4/k>% ?-2?áʘ . ` $tableCell-1-headerColumnStyle*F 6 iw0>%>?-.+Jq=$@J  @a @a @" 1*   Z p@A*Helvetica-Bold@bP    (4-paragraph_6 (P4ZX X:b- (@PX`hud}  ,Tb`.%B(=L@HP] jpx &E R vg`P 0*  r -1-shapes9Z i4h=%?-=2!?"r  m 4?08*PZ2RERAJ .*EJ" Z%0Ž;%=-I*QAG'I  IG5-E<At? Default Fill Center  ??%<% a?"R->G1 8@J 7, ApAA L Directional Key @?fR4(GdH  %Right LB5x Lef =f-:( Medium Top LrR?23:A3@A3m+  %I Highbht?%" -r !"R8!"R!"R!"!"!"!"!"!"^!"0(v>%>-QE.6!"RBTT} bT !"n!"bP!"bT!"n!"b2!"Rq!"!"!"!"!"Ra4!"n!".!"^Tb !".!"B?-}ʔN!""!" 3 .l!2>J33 "l! Al!l!l!~l!.S . 1> """Ό"Q@ +*!&.ZR $b?% $ing 3 Ap#u P3Z#Jen_US#N#b_,B###,A +/category"H*(8MerO˜1% ]¬$% 5c11111G.NNNN0$?%L?-4RR08>%>- TR8RR*111111.1NRs bT3 nb2GbTnb2A RqRa4n.^T_.0k0?%:?-8o*&1. J Zb /$XB]B4JZV).;* *.-`Ab; (?eq@eK]@e@e#AeM]5AeSAeqA"] (* $  _ 2>] 36^ :1f~X1bb^ :^ ^ , 5H  List 26 list3 PX>   jm#2 mCm4X| Cr  a8·ovZI372I4I-IAmX!D"!:FjIII!.2222222222222222222222222222222222222222222222222222222222..).C-4-*. Z(C0\m?%em?-Zm%B z1%(%%%xx x.^!3X   5 NamDXZM8ZSzZ2.PZZ^X)6 *)")Z6%r5.G2*G(GG.GgGzG:[NGAI1.EB[5I0rEIIII.M9$* T 9e S9,er + (Latin)Xtury Schoolbook 14 pt JustifiedF,19)3Z|9<`A* LucidaGrandef,9n9c929*v]?y].a:L, Footnote Text A AF9359*L i-Roman88R:^^!8:s:/FJ:/ Z4[D@*CourierNewPSMTf*-0  Legal *-1^.I&&=8N13===r=:=.'JZA>1Ju2za@*al*  !stickyComment-0*n Zc=`d/ Vs >Fo2s Hjiv b^ke*P ZQ "0428@RZR2RRvvc-N)2vc< 2N:!mVmvc.  Sub-fingF2  R cVޑA:.0F:4R:2:::v:::h2w B5-legende6\ Qq.$* * : J"  GJxDjxDZ   Gj(* yt i ZJ jj@*Ct  HJ82 3Za AJtf %mGBEREfT@@i2i. 8(*rrR|~9XXX.X.h.IBhm4&J@JJJJ z<$?e[۶M[@em[ AA8*{k168{k{k{k{k{k{k{k{k{kbbbbbbbbb"111111111okokokokokokokokokokokokokokokokokokokokokokokokokokokok2ok.f*I192:#28#X:#:#:#n:#:k^7#^I6cJ2U"PIIcJcJcJcJLRIfffffB.f"f&f f&f0>%$"?-_WRWRWnfR8WRWR*WR Tʯ/bT=?//b2T/bT/RB/b2f!WRqWWWWWR!4WnW.W^TiCW.W.>%LY9P$"ʔvfuW1b.v @`AV.0>e!!q)fsZ1. 0  Harvard2)7!R& UU?{)6 ?eO)O ?mR)D̾BmBmCm33 ))0x xxxx xj&."U$$ Bodyc,F"5P32( DejaVuSansj0!it-!R-!J" -! F-!%ar &     e*  e e e e,F>%-3?-ܹ> R R 4>%?->{eR8 R R        R   bTE n b2a  bT n b2A  Rq     Ra4 n . ^Tq . *>%M ^ &eN;4;;;;;;.f/*BsZ4f>Os$.&O?6>=x'^ &ΘX u>Θ 2-bodyStyFƘR5fƘ.h:62 3r6JKfp"yJU6 ZRGu 0;%=-5 XRffv526^50'r?%ԉQ?-ʐB A%vu65WNs3s&??.?ʝ?z?V.lJZ<0A!.1B1111z1Z E282!3U ^ .K6% PlainZ4!3Z*F6>4zZzJ4K6.)RR. .B~}}}Ύ}* NV^5vV^0o?%o?-oAV^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^V^6V^V^@ʆ4&N'LUo T.To T.Tx.T.To ^TΤo ^TΤx.T.T^TV^V^V^V^V^V^V^V^V^.V^Z46P:5P:^.42U *5^*5^χA.= ]U. sRowR 0>%t?-f: .!\O &UV~!XJ!Ԇ:!•Z336gj0Þpapapafpa`@*@2J@w)m'z. @@ kX.Aq"RX6A^b*V(!>Xpn"-1"\ A* "Neuj^ZQE#AB ;!ӊ+cN^SS"1$1.4B=!5?"PPPP.4.B121["f^3n0>%>-4c ? ;"q.!$* J /奖;c6 pJ52$&.1c1c1c1c1c8X.W1c6d1 JX4U3ZVZj(R%#%#%#!8Z26z]qGqGqGqGj! .i1*)%)).)iii!a9&E0$8EEEEbE Br9 :2x92t92p92l9^\$M0"?%ҷ>-l2%w-E-? &0>%P|>-&?i,? *˖@b`z`j`z`r8:|z|azaa~a8*4  r(і^=o0bT7 IN IeH.eH..bʛ z IzH;H;H;H;H;btH;nH;.H;^TH;H;03/?%z>-e*s ΘNQI.H;@  ' TOCtoc&Nde G5Z@Ab`Vg55` .% "G1FG43&#j@GGG. & 1 "gNNNNfN8  Wood :  B  J  R"0|>%b>-i`tURkGR3 nR8kGRkGR*kGn"P6 ]&R g bTg ng b2Pg bTg ng b2A ~zg DRq# # # # # Ra4# n# .# ^T΋ kG.kG0R8>%@| ?-ƜDʔ~# #  $* 352 ~  N}I}D}?}ZI26m2s^.*FUrBs}}t~~uFVPˆ* N#BS= XXXX3&l)nFA.)JOBZt1ubJZLR RIv wJfHb^6 3-OOeeeRe"B *z"zZ &0.o?%dr?-t3~p  R"8  T.T T.T3 . T.T#T.Tz3P3ʤTTTTL.L~ΨN_H0_H"_H0>%>-** S.SS.S *X.X*********>%+|>->5?`@ -@2'%f0Q >%S SSFS  XFX, 0 Helvetica - ?vT>TvTΨzTΨTJTzTzTTJTzTzTzTΨzTΨTJTTJTTJTTJTB*  *PZ,*H-Bold:@ ?% -?u$b Vt chart-3-paragraphStyle_9 f44Z@A*i .(@PX`hu }   foDb`.%B(=L@HP] $jpx  R vg`P -vd  5 tableName-4-shape%#Z)9ZS B&.~" PZ2 X D@ !@5*>7ZA*CourierNewPSMT@bx  A  `B    C( D ` |    ,50*  %}-3)sA)m, Z ^\$C !^ %d3>-x. A? &4.?%=-=m)!V?!#(? *˖@J"/ .L,C@ KD?08*P Z#" Z 0R ML  List 18 list-%D-22)GX>eAma mCm4X| Cr A?I8·ov82>84)K4Zf8$?%?-Mx~8n) ˯B?Q)8ggfgV42246)MX>(xx x.^U$* U :Š Header + (Latin) Century Schoolbook + Not Boldp30)3Z •.v^ `* (!stickyComment-0ٮ15)4Zѯ pA* "NeujZ R ֿ cN  a07 .*| | Z dA*VAGRoundedLt-Normal.6,* ! 1Bf2mfp fffff~f8^06Z ^ "-* <Y :ba.Wt* 6 Footnote Text kSFWPE$Identifier[3Z[ BBbcV<<0.N03R0 000v0B0  .] !oCell-1-h RowE\IRZ6 5N@J]>"  ' m  2-series_4 6 *T ]4@@L*line8"v22T*SFSX2 Green Paper :F  BF  JF  RF  Z)4H=%>->4bjjjr 0-@Tz RpjnD 4r ? &?22nI d222 @@ z24B -LlX>% -X1I TRBTNBTbTg"!KP1PbʤbT.b2jR Rq 91 RWn RBWx~ ɜ8 TRa4 T. T.)P^TΓ&!  v?@> 0n>%)>-*,Qʔ~Z0q9?%4>-*WZ363^<t &t 0t  t t t t bt @ Bright :2  B2  J2  R2  Z.30`|?%޲a?-,qa30>?%?-~3b`z`j`z`' 0g?%!?-t1z|z|azaa~a8* 0    ^=  bT/ n RL k 2# . n b2!z z7 7 7 7 7 bt7 n7 .7 ^TΟ 7 .7  %d?-S/ ʔv7 . & 1B    f $  Wood     0:?%?-ZQRRr jpRURRB  bT n b2 bT n b2z j  b4 n . ^T. . 0 n?%uB?-x R fS!4-footeS!S!."H* " CaptionF&3-&0A*"u(-Obliqy(d4bf"$v"$&51=)%"a(.8e]tQ@e]t@eFA8AeAeFAeEA0+*Q"%ZR(b ?*05&1*#_ .4Z%P%,*j,*/6/6.('H* , HTML Pref*tteJV/51$3&`7 A*C5RA+JQ/jQ/u(  337B ff C 7 e ff L 33   f f DQ L + 337DB7(7A&)i6&-2-E) Z(0o?%o?-o,&.@0_>%<>-*7Ζ6S.S&DS.S ?/ *NB .B *N*NN"q1R ʾMq1T.TtT.TtT.Tq1T.T~$T.TtT.Tq1bT2tpKJKNNHNNNNNNN.= =&=Zb L@>LBKNLLL^L.> &<4-body*Z n<<.OBI0.O0C.MD& F9 AF1".F2Pn_V%H0Pa^-DQLJQZ>Qbv[5R[M3[[[r[:[? ?,0-valueaxis_I ?D?0$9?%*9?-!9h 2$8TJm)zQ}@#bbG?] $PW^R%o:FJ RHP R<*eT7J Z#@AR>mb*(K*Bh Zc 7jfCHf!ixT=^/ 6AF"@JBQAR.mP4>|8mPmPmPmPnmP F} E43-referenceLin Y`^0@G%B! 9Ra-Ka-a-a-a-a-6a-6a-6a-6a-a-0?%C?-} .a-Ra-Ra-0>%?-%a-R8a-Ra-Ra-a-a-a-a-a-a-a-RbT.Anb2 TbT8.8b2A D-R Rqa-a-a-a-a-Ra4a-na-.a-^T6F !a-.a-0q@?%vE?-Z=a-Ra-.V.X]52R1EaRRRR^R.eE  -X76H.X.X.X.X.X".XuQ(*0. ^dZDQPfb\@.` $&0QColumn2Q0c?%Ee?-dqf.atJ Z^V e0>%>?-.+JlvI_Nrab.J0  $& \JW3 .\\\F\"S0Zw0ww.Sd * -sees.SdfT0??%??-?QF!^$6 =d^daw24UU?eUUU@e@AeMe:A Aw2)[ F*"w2Z4R>00Ž;%=-I*1]hN3*2. z F *&Z1*)5ZJ bASQCJ+]Z1+]:rh%R@!  1!WT? Default Fillber X*o?~fgP"R->tiG1 8@J 7, ApAA|$ Direc7al Key @?fR4(GdH  %RBL LB 5x Lef =f-:( Medium Top LrR?S"NA3@A30Q %(Center Highbht?*B(^6t'+fZ46]4]]]]z] *)*B) Z;R|j)k)]T /|`B   C( D ` |   C_/#4&PGvZr///(O(*U3U UUUUfU$ Blue*lBlBlBlB&lLh;%H>-v>5Y?`m(Rm(Rm(nlR8m(Rm(Rm(m(m(m(m(m(m(m(R b9bT=%m(nm(b2 m(bTm(nm(b2A m(Rqm(m(m(m(m(Ra4m(nm(.m(^Tm(m(0;%뢧>-dʔ~_  Rv"!vvvvv:Frv RvRvRvV20X>%>-""V2R R ,8>%>-"2V2R8 R R* vvvvvv.v0(v>%>-}6CERe bT% n b2P bT n b2A  Rq  Ra4 n . ^TQ V2.V20W>%f$?-V Z <wJ}V/.}.}}Y *J *Z *A*q^B>r>R~v0PPP^36H3u^||||f|^1>{A֕"B"`2movie-5-Zi gFRڿB Fb%-$B$R$nzDR8$R$R*$؈؈؈؈؈؈2؈:$'6$R,$bT$n$b2P$bT$n$b2A $$Rq$$$$$Ra4$n$.$^T$$>%-lΘv "$>2  s>2J  $"8u?%6^?-\=5`2@t`^7 6+9v>v8 @ 74'L.WBL '.$(RWW9 .FU2*K??)R=!FUFUFUFUFU.&4.8||||^|.Cׅ 5J 0W>%/l>-i6, 5z晧.R:2!2 >>20ݐ>%"'?-7Wz."0 8<%>-{@&>>"G2`J`2`J`cV".|J|6aJa6aJa/6S#://W 2 =/^?6TfT/bT /n/RYTP/./n/b2L!z<-pzpsssssbtsns.s^T#.#vC>%+G*s Θvs.*M9xiBPVPXB]B8.(#N/ZMR@ ,*=&jZ6 b =^/BgS9S9S9S9.>h0% BlockquoteFh 3Z@@A*TimesNewRomand%R\>GB(Z(6A"7Ar7AA@A@727AiQ.%B:#"!""""n".T*B392!4X""""V"!R>3">3>3>3>3>3:N>3R>3R>3R>3>30>%t?-!R!R0>%?-T>3R8!R!RNB bTw nb2;bTnb2zsRqRa4n.^T.0W>%:?-Oo,v.2 *Kd821 1Kuyyyyyy^PB!i PPPP! ^(-0-categoryv"Zv.v(8Me*rmvu ]v 'v.7*f"P>Yb=̬@](&Yړ@% Free Form Ap:*^/ P3Z __none>&>!5L.&i61 # # # #^ #  :: cSibdbS$ ZD`(: JZ`.N8N63Z.}>&h>c)Bc)0J$2c)8K=%+ ?-/?5c)c)c).[-f[۵[~`AE~y7RyvyyyvyFy.f &"ŪiJ|XX6Lej?efff@eff@e,A8AeAe̬AeAƞ^W6B9    ^  ƶRRRR0 ?% ?- RRV R8RRR@bTʔnb2bTnb2A RqRa4n.^T,??%??-7"uRy:[y3[yRv+n[y*)JCZI@>s^ 36rJ ^ .Q{]>2 "GFyy>F-3BFFZZz 6#" Ou.r0BZSJ&.9:B )_ .0;%RPFPFPFPFPFPFNPFNPFNPFNPFr%K=rrBrRrn]bR8rRrRrrrrrr^r:!5@PFPFR z rbTB rnrb2S6%bTrnrb2A rrRqrrrrrRa4rnr.r^TrrZ%dlΘ~6%.*h046 4 h0h0X' , "4""xBj.0 ! Listl&h automagicNMUU{mAoAjW6ZR. jM.5D )T zF5tA>$z5Z2222}^V4i sSRE%)EEEEE>E>E>E>E2E0W^>%??-q.8"E,\3%l?- /.2ӆE`J`2E`J` VA5.@|J|6EaJa6Ea"" >5?` x? *˖@+T/ A%-\C6 ?0822d222 @@ z24B -LtQ%X>% -X2q !*@2'!3)?%DN T?%!S-?9iT T0W^>%??-qbA+ bT@.T T!KP1P TP.P T. T. Tb2LER ^\$#^wG? &0\3%l?- /,2&i ~ai m Rn MBWx Ai | T^Yt T. T.)P^Tp!  v @ Ax> 0?%,s?-O]Θ^* " Courierparagraph-style-50*P3Za A* 0NewPSMT:b(@PX`hu} 7 I,Hbc,%B(=I@HP] $jpx :O sd]`),8=*  *%ebe@ Ae@$B QH*QQpZ60A*VAGRoundedLt-NormalffX.\ ,*  Z^R\ Q8 chart-0-pQSA_M4ZQ0PA* HelveticafZ b?)%$b`.(R(,58D* TitleBQ38I<3aQaQ A*5?-BoldDQbNQQyM(ܚP4I?eI$@env@@e۶aiA AA'i I$5-series_1%m4 6  @(4@@L*line8"w$ J * C *SFS82  Fun :  B  J  R  Z Tz>%/?-م>5333?`bjjjr 0>%?-z Rpjn 60R;~bTb nb2vbTnb2A zjb4n0RL!3%>-XQׁ,ʨ^ .0?%bR?-0Θv   4 image-5-q  PZ g^Q ΢B F_  Shadow!?r,?08"&`58' Body Text 31F 4" S @eJen_USjjj .I)Atable-3-] Z([0i?%o?-qT$ 3 0X>%>-"+ SFSSFS ?/ , 0!&,&^?@&^T>MT.TMT.T&T.TM^TΤM^TΤ&T.Ts&^TzTTJTTJTTJTTJTTJTTJT"!1*#"#ZRa#0b%X$$6Y$XX6a$$eUU?eUUU!@a$ Ae:A(A-•$*$3>$44Z*v"$?%?-h)Z$""r- ˯B?E'd-?&$$^O2>O5OOOOOONrRe  D  List 5 list)9IX>!Gm) mCm4X|Cr \+8·ov.G  %G 41 =H4mI1IX!D%N %S %X"!I4)I@2I!@ ~ ]Y22-PX+2#x>!VY^^._5>34Z ,++j+! l* l*$4-valueaxi*o*<%?*0$9?%*9?-!9 d 8+m# z8#bbu-?] *6j/,%o:%@* k/8!a~ .1A/1 *5  0 Zb0@!N-&-0-i----b-@ Bright :2  B2  J2  R2  Z.64p?%(?-0=%  60=_?%>-&6*;b`z`j`z`-0-@"-|z|azaa~a= *= = ========^=W.bT''u :2 r-uR;BS Tu.u.ubz.z/////bt/n/./^TΗ+/./_ % ?-*s Θv/.4.$* " A: AF/.2732C::w .v8J*.f*._C:fC:=  .<4>"<<<<.<.8.ZB=! N5*IS&[!zAF *338(!stickyCommen2h@sh@-1Ui PA* "*? NeuejRZm@jm@cND?BB+3.35*354J352R#h2c/ f 5C?*iBrfrfffff^1"A˜BvZx0F@!!5Fp A* &]322]36 X>&    xx^^I62I4"~q . B"-K&H&H&H&H&HN8B8888.8 *^I*B Z^j feJf-&ixOLSV .V (, 24&, @, , , , 3pMJJpM Z8jrMa    %1$t Default Fill Center Z R?#`R"R->2G1 8@J , ApAAL Directional Key @?fR4(GdH  %Rq LB A%x Lef =f-:( Medium Top LrR?"NA3@A3RA %I Highbht?_ b/^"R7"^^^^Ac/R~\~\~\~\~\~\2~\2~\2~\2~\~\0X?%>-yT~\R~\Rr.RR8~\R~\R~\~\~\~\~\~\~\~\RO@bT2!f-n-b2X-bT-n-b2z-jx-x-x-x-x-b4x-nx-.x-^T6&x-Bx-?-ʔvx-.j>*_#172"2>%""""j".'.a,B9F-K*<>@<><><><>"L*  textboxs* Z j\bCh2x?"^0*P Z#" ZRv" 1*>Z* LucidaGrandeb=XB]B.E %* E"Zbmd+9.9 $* 9&IZ: ^ 42  CC#&#&#&>#& _` $t_HCell-4-headerColumn*G Z6 0>%>-;@J B< !} ;45-referenceLinn Yz@k=.3$* P 5 (Latin)8Pury Schoolbook 14 pt m$ JustifiedJ3P3Zl2Xd2#n2n2n2^n2. F6 5f  f oRIUIIIII>I>I>I>I2I0{?%ؒ>-y@.9@y"I4/I?%p>-l<&I-*"2I`J`2I`J`J0>%t>- 2I|J|6IaJa6IaJaIIIIIIII^?6 e"bTn*I.*I.nbF.I^wZZZZZ^YtZnZ.Z^TZBZX>-Ɩ. NZ"f >&4 &U2U!C ނނނނfނT Green Paper :F  BF  JF  RF &06>%t>- &R&R> 0>%?-T&R8&R&R&&&&&&&&R,&bTjr nr b2_r bTr nr b2A j &Rq. . . . . Ra4. n. .. ^TΖ . .. 0 ?%m?-*aΘN. &.0C !&2!(5-footerRowE v-S!w !4-legendG\ $Z R0 .cB}d"D"}d0A&A&A&A&. *eB"3jm!OZ *Z 4Z Ig Z Z Z Z fZ $ Gray"Y :B  BB  JB  RB U jU $g?%!?-U U U U U U U U 0(v>%>-Q} 2 y^6Tf] bT% U U U U U U U U U U U U U U U U U U U U *AA$*%"C08ZAb %w BKA:*D0:"{A. R +{ N BX*g%M(M(M(M(.MHJMZ6ֳQ.1{I&2Z^ :W/{|-*B2BBBBB2Ba,R O6 § N N N N 04?%4?-49RRnR8RR^ N RB  bT : bbTnb2RqRa4n.^Td.09g?%g?-gARA.^e0J9Z:RxeZ0.r O8&OZb {@n:6 6&{66 NGB1GGGG *8b\* & Heading 4p׬3186*Yq"rl Qt  " APB0AEN3S"=SSSSS Blue"S   J>  SDף3%ш>-?5Y&RR08>%>- =SR8RR*::IWX.T)SRBTbT| SnSbPbTnb2RqRa4n.^T0s4%?-ѺPZ "u V[L>L^\ B{w&.\ ((((. .(B?P(((((_OJVLMv*T+SLZSL6:SLSLZD382D4-#OOOO^OaN52PK]OI"Index/DocumentMetadata.iwa@G VPKIF)s9$9$Data/logo_new_m-16.pngPNG  IHDRP]~4 pHYs   OiCCPPhotoshop ICC profilexڝSgTS=BKKoR RB&*! J!QEEȠQ, !{kּ> H3Q5 B.@ $pd!s#~<<+"x M0B\t8K@zB@F&S`cbP-`'{[! eDh;VEX0fK9-0IWfH  0Q){`##xFW<+*x<$9E[-qWW.(I+6aa@.y24x6_-"bbϫp@t~,/;m%h^ uf@Wp~<5j>{-]cK'Xto(hw?G%fIq^D$.Tʳ?D*A, `6B$BB dr`)B(Ͱ*`/@4Qhp.U=pa( Aa!ڈbX#!H$ ɈQ"K5H1RT UH=r9\F;2G1Q= C7F dt1r=6Ыhڏ>C03l0.B8, c˱" VcϱwE 6wB aAHXLXNH $4 7 Q'"K&b21XH,#/{C7$C2'ITFnR#,4H#dk9, +ȅ3![ b@qS(RjJ4e2AURݨT5ZBRQ4u9̓IKhhitݕNWGw Ljg(gwLӋT071oUX**| J&*/Tު UUT^S}FU3S ԖUPSSg;goT?~YYLOCQ_ cx,!k u5&|v*=9C3J3WRf?qtN (~))4L1e\kXHQG6EYAJ'\'GgSSݧ M=:.kDwn^Loy}/TmG X $ <5qo</QC]@Caaᄑ.ȽJtq]zۯ6iܟ4)Y3sCQ? 0k߬~OCOg#/c/Wװwa>>r><72Y_7ȷOo_C#dz%gA[z|!?:eAAA!h쐭!ΑiP~aa~ 'W?pX15wCsDDDޛg1O9-J5*>.j<74?.fYXXIlK9.*6nl {/]py.,:@LN8A*%w% yg"/6шC\*NH*Mz쑼5y$3,幄'L Lݛ:v m2=:1qB!Mggfvˬen/kY- BTZ(*geWf͉9+̳ې7ᒶKW-X潬j9(xoʿܔĹdff-[n ڴ VE/(ۻCɾUUMfeI?m]Nmq#׹=TR+Gw- 6 U#pDy  :v{vg/jBFS[b[O>zG499?rCd&ˮ/~јѡ򗓿m|x31^VwwO| (hSЧc3- cHRMz%u0`:o_FdIDATx]k]uֹ3c;ƀMI?RP3Z7ZVMmʧZLb6=ү%Z4sbf8&fnV}?|u h(Xb|tر+fuG/@XKT.uL^_&LOCbsTw嬞mq%V*(\ Gx쉍YnkT朐wΚٳ ld~Ͼݛw޹LTL^pt7^G)pOLjy` rZOg.N` [89Mdo(?ǧ-yq \0: ZAqH3=Lf-Cjǔ{sZM;QD6dwM ܜP& D-XP e0łfGjFʲʅj[8@Ԧ$jtA{nmb2)=l/w\leCrW"Ze8M~l8ybUQQyR9R&i&z.N|z^ yfXkPN:4y9.:dmݚ̨9PYՒV iS^. )~$V5 -4ܗs8x5ـN`W9m]Gq DFa>9WYSŖY}^NJ'8/,t` p*2yx CgPSKڵN`-ٵi(U4FU@OUY;%&8_Yh:f0*>u l\[y8o^r]^yiZwl^7˰ʘfiÔT22X3p['-dg7۵[ȹ-\ ':-_>|i@'5,ƥT(j2mu5bysBc*Y)؝g5|m/[]T|Rf.ovp˸4-g(ȚҀkl4x#f]Z紘bnWRK)bEq(=fc2Up|T9 ^c ޹T&3WF'V^l'WMtb!C%}1k9iXGX]q`3 TB.\ ̕+dq{t"w7ZD !ZT1Lu j(j팒@XXRi [xiyMԦH< 0.N~Y]L? h'Ca}@,񨕆aɮgлX|z@ɓr3K.]&d׳ ˱~!Tv T3t') + Ѷ7pr=Vq{l^j2 /!8dn`EYr'I>`%,RkDlIFgu l]j&5\!?=*]AdoG*c[@AjR'B5͆awhugg{py0z2Q`p$/ؿE#un@߳@&.Ѕ(ڻkh3;ۻK_-[? Š-gdҹhiםBeUƚwFhiD\= /(\xU5[DO|jZt /@'?H`y3[6wog3KOjXj-9- =V2l)0m<--{l11CK [cyo = ^)$Z5hf'&E=`j@%kc3C_w[\t)kvφm]gV}`j&`e \S7X>MlN[6ƶ_ L+ń>; yצK1Uy ld'SX1. 򝥰 ie&3S#z>=ۂo*AN$^TA("NsHb,ZiĀH{/,ťX2>SSd&1ʤq=9ys.TKw2ξ ̾QPݠ%_w u#:Ot#TPTɂYP:3%F@9@}[/|ɟ+6> .{he9`(`YB(mrP8%7@jg]V"4,qfo{ <1bvTVƽς>еΓ@; '.axxx~}~`ju2>4  TwݿXt-aN笡nΩ6K&%XS[9dax5ƽr飦3ى͡!q u9ȧEǎ_@g t.ɭ_ty7v jxp['h<.xSp)=Շ$^mWq,5I0Mq*7D}Co+"UG80~-D u'OOJQ`*`\{AfZ<0&`U3nNq3du{p|LcqB@_r=6:.Ky=U\W(l_PgLֿw=TSXU*p䣴{ç?!ѯ)u)FgYPiQ&&5 Z:KM|8-3 b0s;V1֙8e/z&O,DmQP;P>N :T$tm (%Zʇ 8>B%hO*Q_'@{Z#5g!K|svp-G;M6fyd\'0OݒǀQ'P^hrbw=Łs#FDmBPZ< 4j@ 4A@c hL(&oȣHVB"u烙RwTJb!np!AڞMf1XNl-(w4x <'I@TsRSЂM,ܓ E_:T@tp{1S" A8cr4Dq#O2Yk'ޑn3LE`M~^6s]y9 ;;< Jhjޥ7wv , X9SX^$2Y  )IᑔP`"Eb(ϗ)#"ʀ6/]@CVQ̅ {M޹!5Y֓p~fֿwH?UU>PMɘ3 2-Dp<=J'JnGȶX nIe~ed0A>&|p{G6ùa.]V[mCrjI$B(7R9AiU('=XrhX߶['iW[e& 7@zXdJuCFYc}V? iڱǁy+%y-']chѯT8ӷ(]m/ k5oK3c46C !ɹ: ޸pO"Jä&(»o>oƽAk0x}{7 Sܷx5 ޸VL< n+9_ X|DG? do!mkjJ˰ 3@kyWxq`/HJνtU"(=ca̍ ?AmD'5J!LzmYȷahwa 3Φۭ]hH0D /1z3 oq2t5A =C;oS`"``5([tp,]ӟ DjyMpv!=jh 1xC1z~WCq#?.Cl;l;jЕGP(`JQ`dTR`opPiN"Juk{dm*60LP](QLtjL)M=CMK>JQސ ?wMoQ%ҶZYO;"{6qFAOGa`l%S]V |7BՔL05dXKE&&eAXx-~3 塒MkT:wF[E!ʖ,b$F7)뒃<e8r hGȆ_d6#րҩ%ĜJr:LbU0jYY7k@ tޟ>Cf_lÌ r rSkYeB' 2YuPdG+ױ__[ iS([ 1n eo1yۂ6hX9+dop# l?g@U%iuR`#:3' ebTӤJڄ+!X|;}m$kv-D`B/и_xnWz")Gj Y$eZ03ƒKzLQL!~ `AJT{}ZnILDJI\B2.Oe>3_PI C(9F/,]GƗMcO0a]vwx:(dsl;c$?`Pm^rM*'>rrFIp9W)iyaJw7a?}M3Vg$u}6j@VGʿ#J.:A_ pj<!^0Q` /p׵+/w>0QKf}RcwojC`a'UvYVZq=x_ L@9&5K;}(3$4y l2%8 pTpXb&q D2 ɛi'mZ 1ijgDjI13ҐL K'<&ViNUg\q\3=v74ÐZP'''>J&&,Qf5 S=~@Lm3X; Fjʘby;:;1IENDB`PK!]OII> > Index/Metadata.iwa:  U($8E74DB19-E571-45C2-9AA3-D7B1CD5D4A74"GDocumentMetadata"*P` 5Tables/DataListTables/DataList-2"7576B775:7 Ž8482    D2PZ򙣴r6Z̅3_Z6련uZ鿦Ɏ`-Ta%iHHeaderStorageBucketP%r3:76J7 w1-10:85J8B7:7 ^ Tile: 5ŎW8:74& ViewStatU2%` M_1_I Q %tXCalculationEngin.2Ms2    M7 2 (2 EĦзZ臣UĬEnĎI99I%1 KnMJ.M(*Annot%|Authoq$2y$dD,StylesheetF -221]<:PZF ZRR!RVR8VVVVVVVVVVVVRlVVVVVVVJdꚣΥϩ"VV!VVVVNt߽ǧkѨHZVVVNpV38V8V8VVVpVpVpTVpVTpVpVV!VVpVVVVVVVVaVVVVVVVVVVV!VVVpǯӤ䧂ZVVVVVVpVpVpVppVVppVppVTVpVppVpVpVAVVpVVpVVVV4A0VVVV!PVVVVVVVVVVVVVVVVVVVVN( L쟹إІVVVNpV5VppVppVTVpVppVpVpVpVpTVpTVTTVVp!VpVpVVVVVVVVNqaVVVVVVVVmVV VVVVVVV!\ԽBZVVVVVVNLXhZVoVoNoTVVppVppVTVpVppVpVpVpVVpVVpVVVVAVVVVacVVVVVVVVVVVVVVVVWVWV[VVVVVNš[Xԗۄ[݄6ZVVVVNVOVpVpVpTVpVppVpVTVpVppVVpVpVVAVVpVVVVVVVV VC'VVVVVVV#VV#VVVVVVNʡ?Xӛ쇼_ØUZVVVVVVVHޱEӳwPVVVNpV3VppVpVVpVVpVTpVBVbpVVVVVVVVTVpVpacVppVAV!VVVVVV4VVVVVVV!lVVNMLРΟMVVVVNVpVpVpVpTVVppVpVVpVVpVVpVpVVA0VVpVVVVVpVV VVVVVVVVVVVAVVV R~&`ܭЗ㬢Ƕ VVVVVVV2 D"ة^'VpVpVpTVVppVpVVpVVpVVpVpVVpVVpVVVVAVVVVaVVVVVVVaV VVVVVVVVV\VVVVVVN1Xߝާ>͟LZVVVVNVpTVpTVTTVVppVpVVNVVVVJ `(*2&\2U3 3 3   (  (   (      2 @ (   86 ( 0  0  8      @ h   (     @  h  (   X  @   H   )0  0   0 0   (  @ `   (   P  8    P (       (  h  0  H   @  (  (  h @  (   H  m0 X     @7 7  :  J z   @  8  `J  (      p P  0     @ X   X  0 H      @ X  p (  @ !-M}< - E -      ( 2 e  = --     m 8   X     0  `   P H  (      ( ( `  0  0  X 8 (   8 H  8  0  H @Me (  @   ( 8   0   8 0 Ǎj  (   8 X      P   X X  (      X    0 `   X     H    8 P 0  ( (  H 0  8  0 P-0 8 0  ( @  d  ( @  H   8 8  (   (  @  - m 8 8  0    ` X 0 H   0 ( P P   0    `  x    0   :"?V=VVVVuHㇱE8V8H7ع檳8VVVVV(N(tݑְ4ݶZLVVVVVVVVNtĐƕЪZbZȩǕڣ?ǶZЀګȡ0ZZNUH&ؐA8V88HuɄɬ88V8!3\̜ݪZ8V8VDHȺ 8N8GX|赩 Z7V7YXГ_ﴨ5Za\ԅ˾아Z\琹ƾƛYZH:نA.a`XТĞ:Z7Hť;m1\˳ިѱ˿jZHӼޠuכAJ`˫!N9H-Ւ\ʢփ-Z\dž&Z\ꐣɧ(ZD캬ʧ !\IJ̕ճێHңp͛EZFD` "VJRApi8Gǎkh&gsimple_noise_2x.jpeg*ginger/00_theme/s6&R"BVlogo_new_m.png"-16 D*K,2:+@ PK!]OIBBMetadata/Properties.plistBBbplist00 _fileFormatVersionXrevision[isMultiPageYshareUUID\documentUUID[versionUUIDV2.0.43_'0::8E74DB19-E571-45C2-9AA3-D7B1CD5D4A74 _$4EB1C224-431F-4655-A085-C0EF667188AC_$4EB1C224-431F-4655-A085-C0EF667188AC_$8E74DB19-E571-45C2-9AA3-D7B1CD5D4A74)2>HUah PKIF֫$$Metadata/DocumentIdentifier$$4EB1C224-431F-4655-A085-C0EF667188ACPK]OI [<#&&"Metadata/BuildVersionHistory.plist&& TE-v1.1.1 (Jan 16 2014) M5.5.3-2152-2 M6.0-3507-1 PK!]OIT#xx preview.jpgxxJFIFHH@ExifMM*iԠ8Photoshop 3.08BIM8BIM%ُ B~4ICC_PROFILE$applmntrRGB XYZ   9acspAPPLAPPL-applgFKDnu descecprtd#wtptrXYZgXYZbXYZrTRC chad,bTRC gTRC desc Display P3textCopyright Apple Inc., 2015XYZ QXYZ =XYZ J7 XYZ (8 ȹparaff P sf32 B&n" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC C  . ?((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((q1I'Xu4ݍ&-QTl?/Qa?bú+˱ra?b{XwAعESѰGE}=;r\h_أF~"{9v.QTl?/Qa?bk=(cP'2OB 2"I=-5QE1Q@Q@Q@Q@Q@Q@(((((((((((((((((((((((((((((((( VH:+eWgvM}cSk~#T/*4:OS֟>-g:E2ds^e9]u]E3  ̻!1l;6a&Vh>Iڠ6<}⣾>uvakwpҀ"qӷ8c4Ѵs(U|һO =3^M8qQ]<ӈS Y&_A5k5'Lm|۝vyb[=˩B5;|c+ʏ#I9a5Y|(Ty$ ((((((((((((((((((((((((((((((((((((((qc9mQuw]I}kkQ ʿ):o'k1h,"ןm?aJ>ק'}Y=k(ԡ %MPtW㇋=;ݬ Ť0N6NNk *e0,K"uqh$k 7Ş:u̶,QG!wh88g}*0wIwm> [*՝'}kK~}kSS6yK7Ι?;Ꮃ "&y.f,َIBI<;ד|H+D.Z[l`ИJ$mˁs>|Rv]S1j6FvvBrF0k:Yxk_[n|"gy{Omk_"ׯmcF8ybN2yW~1C ܖ˧\yv gw>G_y? ci.ɼ>L]rq82;澻~j:Lp+%ˈyPѹR{eN;W*5͹sJɶ}ݯm>5ì?uhԊQ]W=/:yϬ_"x--.JǑk/f ?ÿ #ҾxsNm[ 䂢fOy$N1hMFNSzm0ʜҾ O ^хwK彏euLUue.No;m| imQ_Q@Q@Q@Q@Q@Q@((((((((((((((((((((((((((((((((3U~?뼟իB7\E|㿄n&4M2 i<ǒx,sR@=a_x>xs^mc>&M:[N嵕xn 5¯B2Я9_!?J_px4`y / O¯Bs_"KѴy / O¯Bs_"K2z%%Ö=`(XҼK_u(_}'|"ڴyevkx> K6K=vF w2Я9G*+?W=?)W~?ak]Ѕ}5țya ~74-G0);52MGP9[x>RlLǎ9&R߃q]qmg}V9)Z׺}W+󰢊(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((3_| :JOִ? j}ڢ;Asom# Y`Hu~?g/ ";]S6ikj^D^Dk\mVvj*DSoet'~vmY;uv5n.ï^0}#q5ZX|g̷3H8 H^_/Bx͕nIݩr;TWg ‘\-6yfXVr\OhZ|UW0xCh/}n6\^ZUOyq@|Tcf}ZMe抭:M4:Wٟ4|8#iĽT6ZkX-/"*vF9=3⿲_x4jjV{hѼqGKHTĈX+;\s5] gDnR+so\,M:=_K)`,gq_a`!_! cZ1A4 hlQjm%ċyc-y$J zyZtO{-As&JoӓkxmZ⯌#A?d+OykY+Cif[Y4I"?_z7  WU\zLj%׼c;9.uJ}[DLp@;"_] ]xS|/mVK%յBx O.5c(gii+}oo)8Mdm-kV龻_독n^7S+/hҿn-P)p(VV1ʈ0$`N_KxC/Í_O3WS֭4+wO:5i-x9m>Uw՛J^ R+ 3}M30jɱrɵ8auSjEi)(ݾiyz2M|5Ə_N{}b] \ٯ$<` *|e/_<=?SJo4JV$ڔF]'=0;~՟4|S-f16bj8|2to܍ҿSZN^Uy}_;=:tWWW_i_| ~ooimqZ}Q4 }b^ ~ў(~/ETiz-IJ-ī ZQu#̻s|vvԊ߻gӥsz(((((((((((((((((((յ#AT/8q\]ʐBnw*'pEgzXŪh1\ZʓB] SСQEQEQ\׌AgeV{(T9Iw!FIdMSѼK O[-LAK;<ۻfۜg(E2I#w2$r}M> ( +wx N|ci6uѹU㲀rcFe HUPȯ $IYd0=#}/Z?[\WXlcOkLB[KoS4[Ѧ:avUXAsw 2~v 9T45w_, tmU33c2$(V"Í du:xb{ڶ\IQ5 * !?ODm6nIӥkmv!s3kmIirj:V=ċIQ@=MRIRSXH;w͌i8N\ۼҝ˥7N+{|ȣ[ggWşx^|IA>-_U#1'UVCh7'<&Ǥ-{Դ/p;#4lBWP|ݿ's'ǑmʒWUd7S? ~[G^ ^Wd"|:7dgL>#NѴߴxko`oSjvjSȲ:т bˏ-ƿ{7-(vj"9 \ k޵#QSCۤ% x84Ҝeyu^ZޗKh:NkG祗Uܾf?߃ ׭4kTd[h2#+C٧> |qssJϺhWB*,A?$l`]@,2;ga1]9R%ּcwk-Bmɾ\\m)y]:ok//ĄMOߊmrDuKhmY$< tbA)x=kׄ-##YOoo\]4byeo)0 }[-OMJ /m9n-EiIylWI6ӎTʌeFz=-KUd)GKykmޝ8|9K9ӼGxGx?Kps.G5TVi@,[ ) oxO IԬt[8WP\Hx8~F>򢵝%&YumJ*^^OOoIÞkw[3~<|Oc>;7DfXs@ϵjf~ |F[.tyu}PC˚CUr-')-#oKB-=rRѧ_?+;Z*~΍ǟyZ[ ;!i+FbDx]3}n|'4jj1mvVS]Ӻ)U%OΏkukcs}m /2,tI`'ҩr!(zA%/ZT=ɻ)'o9]3O~?oA#:}֙};K]HA*r5Nd / 5~5x[Fy" smb3E3a<*JZvc>]CeglI.dXVwr@Igk6GmjY^*-l]y.䴿ͨP>/zq驠LzIP(mg2.׃m_ڗ |1ᾍM]՗[դ֮q[ڻ=JYm%6?}֯ZZ_^~ΖK*#4hdeXP!A‚zVO|g_^uK}gDԕ2m}"ZkዋKjTզԷ^e_|}35{څMo3CnmBҴI#,ZK||&~Ѿ3;g*x#u1ci 0ۨ[_e*@})8C٭e{~m6&.wݭP)QEQEQEQEQEQE(((((((((((( mGb+fxjV]2}SZ{g.Z(`XH4N2~W;n>Fld *Z?>%u-YchًH]iR{+1i}ͧ] (^׷{wI\>!K:&6sR Y.g[f[ybwbe;[8nKѩ{K^'?>$;]6Z~c[[ȡݤp?eGǟ:M3zlsCJIX'kYn5)bGKi *#> ;)O/IjU\nZpVNu5~ֽTn3PUV^ae|4ӭn\R[$W3Q$r\ ףxc4s O0k"fʔK}eb .˗8 ׹N!xH×:^k6$ka̒ن]>Q}Wo˫eJP|LռIEl|A;N#L;蝮nД-Rݽ޻ {YGiq'}·ծ|) >fk-bHҴME-?uˈmyQ4dJT2|?kO^!{/EMQͻέM*4n68ŏ~'ool?jztNx浻dh`kMw'Ls$6t><;o[G QAt2L"_DOj)y}40Su^e[Kzkм=#]kš׆/jzFwDwzxme;u"&#޿OOƫ |+֯5(<4r]-L?hfqiw:QZs^ܞW]o[W]ba&J-wm9柫~q";=kv5hu?t T|'+Xc_> t%|Iaai]:U", #c 3y{&=lP4enmHLm.995ٓğ ~3|ohΧK.44ko546V U#d Fm;6OgtknRJ4m_M4m-O>+|tZ~>(l<=šfaXGZ\a 䐈icxj|fN׍<k᷂>xLfK{)TN37+?v+ԼWe_ z Σ[=5ebF;TYKẅfb̛OSٗeoWūv:x|IMIEvŧ#ipF% v ۖNVO}X+{ >=]ףe{m& 5i_ηh)/ xD4uk{av{g3+2B5q\'jZ'¯@|chWz掞!zy1NaǕe؅`>៍5\xQ+^]Xy/]\]-Wn7?ևe.ijXү[u0\v3I4 5Wקkz+d-m_DKv{5SMSU_ xj3s u6}P$ ~|_AW>mm>m>ؽմqJDT4/WZ_ N~_^LϬZ|Odaa.WP_ 'ŽC-øzdLZ]o-z+_m mcFsc80\ wS (Lddsbx^>~ euucK4jj7VA^PX  g۾~|>|T'Z2x.o Anx[mL^I>[Ŷ|vA$ Ɗ4Ke?>N8]_\3q#JMBt~ۦWORvݩ5f]$Sgw>u=zSWqj2w;Hk>2pi:7-+.=>Ëvm;(]gVǙY0'./ayy?5yk7-+k/-|\t^u9WQ 4s!bH$"> x_W· ~)Y]m]B"o(;R%غ$x^пj[RzტMl,$pb<[`6`$?ZvsT-g.&ҭ;|k+-܂L"Bn 'ZmE??{z˕QEӲ\s[{XeemfA)> +/> hzg)~??Zhv^\AOu<9 4#o0X2vjJWt󽚳]tSiiu%o6zv}>!_)& ^:? "f2h䏴&t>!~>#ğ5oKmjFYM>i4h!jʍ K/B<ㆱᯅM{t{G,%y䰴̐yJn|$]_Tŗ1>玵Wvj7[e#YLhT/7m}j''u|h=ںi~*K|@/?ZUI TR,MrSAog/|mcgxIԵos#SѮdOɔ$@K c'+߃o|%x&}}OG ہ;ב4bUOg \gO} S[VԵ ח=Fb8ug 5-{rt⹔I?n[o ujZEſ4 \qZ7[ź۫ٔ$ }ߎߋ>Rj)k~H{yYxy{srK,%O,z ^~ |"él ؋?fۼ2]{:~=ÿZ>|EuO %ŝ,w30k`#zƌD?5'Ȗm)kq\ͫ]wnokÞO=xY5Iz^Gkon$V $ (#8_G; jZA,t ͮmKpwc׿d&>:J_!|;xwrˡ[VZ0Z^E]„"”<߱&X Έ, u[ MG3ԭtQD#X|FexNOeҢq>qipQO!eC*co1_B9ghmr)9K6_|72~ ?ğGºkXxzCcx^i.IemχouxC&6H9ͥE5M#ܥwr,{+z+om/-6lv7Ed۾ըeg?/;>erPiZ&麥ȷHf77H乍6A)~?O+^+4 /Jf/;"]]rDK0P3hxN!xH×:^k6$ka̒ن]>Q}Vރ0I{RZ׀OxNE]\M_eq&Kk.c%l\ZksY;:2ef_v㺎͟|Ş u/^R?/-|[_X\XwZդces&d7tυ^Ys9>xSӞֶS%b-mnUkEDF$DP~#еۏ5p)6[vy>nۍ#_w6h _ڞg:Ε4Esies LV®F2|ES>nh++.UwSp󛅟ZyG;~^I| <'k"f˔K}eb.˗8 }jI]JpQ$jqQWQSxU3]Z[H/ֵX/-V{%] 䵤GQ{}|!SÝ `^:tSA9/RQ_fc"C~^~|}\5w/|`'TQӭ𥾋sd]۾Ԓe8_gG|i›/|5oe5Kw3<;Y H@^J*Fk=a%IG}7O朚A(*PibQ7 uvG47;RVEgx"v|NN5<6smmq%h&+(\&gow*m_Ejm^Ndru`6>5ofWPдi_qa#[򫖍R˖(ʟ7EJ_mh-m7-x `X,''jeՃhZD^hnl7#PV0 i|(?(:{[I?ch}JmPa T#Qw)+;%.%9z([2Ne[{^QEQEQEQEQEQEQE(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((734m.5$E #V`Xla,($3կtMziGbV<˜,Q( qWg~i}_ \zΝ{ t6EUȽC/\v6VLί sjGKSTK 2-~˖N-x|ZRK'X4K MbMөɖ4H ly)HawneGr^~WѼmŤ_b hZ_rFPM6 Bd1m…<~0Z^?\ZkaXoQ 5}?PXKSw‰o{4-% qi;[]dg٫;{Q_z[WvV?l*[h]z\ʶR%.8 I&>XFv<*@?w ow:?>Ӽ%c;BQ?I41a=ŵ^NGTxy[|Og7lH mqi](ޙ,GYۅ9A%_=_s=/^ݯF^tw=w ?3T1 7_>x;<7q4EHTȪ /KOynDZop,2,kʒ3_-Z>;ũi隵Z{x/)bEΙS [_˵.)=aCxFekڍV$~hErΩ˦A  ~?y/Fv˙lq{}oo5.#Kɍr`_*"߂2%KKoO0~-FPO+UolmI!W~-]GR|3]Nj7N? GPΕIO$^uP E0֭'euw_K7eg4RvMvtƟŚ׀R^_@oH] &1be8#=Eď0YxEòE[i>6v푅i9τfV|[kɾ!*^ižǥEekDSwPY[4_ǀFbO uTn.V4(u'K9.7jG*,N|"m{5[X '%m_94wo>w|ghf<:|y>{v"ՌIQ;#%|5֏ok:}Z}ƕ[}RKk+m3j gE˓|=ڷ- M ckF(浶&&g"yeU-?? ,kXkk|Aۓj:նw{yt.c8gWH(Q^WOt󕔵JrɚZ+io.ERo߄QO XONlƑi)O6Xn F *X }⿅ccѮ4>5 h^[%ͬC$xpYIē ;qo$O|?}T[}Ӿdqg>]c"4wX| >xKYFM'n6Pʗlf{lR3I:@H»*Q.*J+Qji&Ivݍm(C@(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((ngBO>W!6G5Q ƵʁCB#$nS5;LLg諩]tk]u}|Mvj467[m߭v~߂7|vxJw>na]bu -llq$X8 Ծ+hw4_\>WiɥZO2]CizU *<@RTҊ"PKg'{ݾgweE$+ӕA/{o?V0|VDjKz[mm!2Ej~_BxׅATvP[}Qyu+I'(ofEygfr;~VJ˲jkiwmo[~(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((PK!]OI/]preview-micro.jpgJFIFHHLExifMM*i&68Photoshop 3.08BIM8BIM%ُ B~6&" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC C   ?(G_u2AQw*|suW>&Òq}կ|=Xӟ4ऻ;i#P" :S ˍ^)J<{A #ymӎsZP+ws#X@b24ǟ0HN= cwm]~_+)=q}9C/=N(eB9Df0젟ү7Gѐ#X:^d~4`Z(((PK!]OI preview-web.jpg JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC C   ?(((((((x{L{;1l\n#Wz`a' ֊ktNeɥ(ROꨮQ|qF`R$~dbb %٧֢ҭ0+(((((((/??{l؋|’y|P@+.d XL<%,6yVF/elm$ ŽH&7<M~U3*j9,')KNͻ_^մ?Hztjo(1U*JvS/|@'Æ9KIn3 XHO>c`cdMGRY`GB lW爝jՒ*JK_}ϛ c1GS_3QE}Qg(((((((((((((((((((((((((u_48#27,62@XDž@ \`xSm<;yHE 3vP3W7ᰇS^[[vC:^FrNrq 2Ҋ'S}zlHV[6BLx|'i oĎ/X\k/yYcgW1nMbw7 wTW7?j#H/pߺ(UMo(((?Kjz%ֵ]KP8 1#~N\6uk7*Mj$lh}< j'_X$hg|W2%T4o &EP㇉M(Y1mn 4 . 7##4l>1k7x^#[yM$ *|8SSkzLZ4HpZB! &2YKX"/Cq+5m5n,~uqM07hU($E޻YE'abQM"?:ZeI5EmV)^) 2+ʹxJgO,;8}ur SI3yXJYxǟ('c oh&gf̳W-cP%.G[kAtCfI럅 Gݮ#[k [ 4nNZ-I?dN,kyk ޵S{pdpI_̙|Y(. @\7|/mqNAQH(((((((((((((((((((((((((((((((((((((ԵGhW3"3$[ (R^X$:֞aAsT361>PEP(((((((g|mKWF)pj:d ] ~ONEOE_ 7qXW]MkQE(((((((7f$Qjv]2,&CSч#^9wE <ecۃuSQH((((((((((((((((((((PK>!]OIY1UUIndex/Document.iwaPK>!]OIFAUIndex/ViewState.iwaPK>]OI9XIndex/CalculationEngine.iwaPK>IFt77&^Index/Tables/HeaderStorageBucket-1.iwaPK>]OIݰAA:_Index/Tables/DataList-1.iwaPK>IFi_Index/Tables/DataList-8.iwaPK>]OImY`Index/Tables/Tile.iwaPK>IF=)aIndex/Tables/DataList-7.iwaPK>IFFdbaIndex/Tables/DataList-10.iwaPK>]OIH<<aIndex/Tables/DataList-3.iwaPK>IFZ9P22$+bIndex/Tables/HeaderStorageBucket.iwaPK>]OI6W;bIndex/Tables/DataList-4.iwaPK>IF&dIndex/Tables/DataList-9.iwaPK>IFp^%%dIndex/Tables/DataList-5.iwaPK>IFyj3eIndex/Tables/DataList-6.iwaPK>IF*3eIndex/Tables/DataList-2.iwaPK>]OI)vmm!eIndex/AnnotationAuthorStorage.iwaPK>]OI!gIndex/DocumentStylesheet-2211.iwaPK>]OI"Index/DocumentMetadata.iwaPK>IF)s9$9$Data/logo_new_m-16.pngPK>!]OII> > fDIndex/Metadata.iwaPK>!]OIBBdMetadata/Properties.plistPK>IF֫$$afMetadata/DocumentIdentifierPK>]OI [<#&&"fMetadata/BuildVersionHistory.plistPK>!]OIT#xx Lhpreview.jpgPK>!]OI/]preview-micro.jpgPK>!]OI preview-web.jpgPKnDPI-2.2/doc/nDPI_QuickStartGuide.pdf000066400000000000000000005475441321103654100173500ustar00rootroot00000000000000%PDF-1.3 % 4 0 obj << /Length 5 0 R /Filter /FlateDecode >> stream xVKo0 WhE=[ŀ/G+b'I/p / !X }_W +PZM:^V;s-1|BAkM>m֕mFWs*I[(>/cqN}Pi&r^tEX ~)|(*jaQ[@TXIHj`޶_[ cR(2gvƪ^OS޲ɓ~ sPȶUu2PBȡM(0 U98`,߇sawgTl{rC],x%&랛*8o8;$x^39>tϟ)bDwH}^mxE]sJJszZa X=`#HNdTLSn%7حP3n c " 6$%)5MǂO}YjBY MQI$JÑB}n@+Vfe9`0!L[H,kj?D!Q#hWK1VY`'kAyN} Z"c. R04V$W))PqDIDa=ߐ$7$ؿrYoWrj ^AR tH!ԅʍ~xYM1JQMP(HA~]ׯ7@0GBK<2=|PpDo+ endstream endobj 5 0 obj 766 endobj 2 0 obj << /Type /Page /Parent 3 0 R /Resources 6 0 R /Contents 4 0 R /MediaBox [0 0 595 842] /Thumb 12 0 R >> endobj 6 0 obj << /ProcSet [ /PDF /Text /ImageB /ImageC /ImageI ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R >> /XObject << /Im1 10 0 R >> >> endobj 10 0 obj << /Length 11 0 R /Type /XObject /Subtype /Image /Width 86 /Height 43 /Interpolate true /ColorSpace 7 0 R /Intent /Perceptual /SMask 14 0 R /BitsPerComponent 8 /Filter /FlateDecode >> stream xX{lg[dDyǏɖϒeɲ?67ws^W%P^vS}B&bV)`K -҂\6/ F`LF2t9;sy+̰>99=;ٸY,ٸF8a4eFۭL'ˬטd ^!F˝铼o&n(ك;l O$l4* XO@F(5`_A4}uBD n)L]Fq?v [b> tP+H go$$ mc]4{ƍ۠KN?iϓxߓH+@nGIKƿݕhC}R099'2NyomMFbMd>6Cm$knd&mlJfE'` \T֋frb0s/&߁%6SX? O-j3#xw'린3KSC/[OAuSphLb$F i-uv`$h)ŖRhM͑v.מ Bwڱ,n[TƊ 2h( k'ډ~od߰'`~#XkXe AXuǿp78+5>v^(1t aػ,]|YwL<k dLL@75n xu%,'md^t톤h#h ?՚' ߇C0Ѧ[Ql, Oh,)goK"xX#z>źq9a/yFfG:(4ؔ;.ڋknkخG&vrϡ3X]7qej/"^OQeN-)A/~UcqJx;PutK>2 ,.?<);S@MW; ^"杤h4^?T. 'SX1sgc>gg8T^rzKpΒÔR/I\aX3>) r@h?ۘ^gz2Ź\Gdy;/-H:V1ҜiLwۇ|#b8K yG&S7͟-ݝf< X6Oz)QM } jiNig > stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 13 0 obj 1597 endobj 14 0 obj << /Length 15 0 R /Type /XObject /Subtype /Image /Width 86 /Height 43 /ColorSpace /DeviceGray /Interpolate true /BitsPerComponent 8 /Filter /FlateDecode >> stream xc`JQiᒥT=> stream xWX>HJSF2dATbH!( --RZ(.nPPKz >|g|=@]ȕHq@8_N¤ @GIp = `Hr5q(|A:[? 'h %Bq* *k r!ܜ.љ-Mehɖ!6pvC| ŏ DIB bc" X HcF\s!X4қ/ Y3(. 6 Pٕ 4C1G=a(ΎDz!}JW0Y4QE!.JCK=!ɖ ƄN*ECiq!R4(b+Z+Hĸ@r<Ġ0A9\Z`[%M g,(π8ht832Yȅ о}}y㯁 B4t%оRˀxg#g-u4jɅ+r]#됗#@Š!䞓$ A,6)QrolL'ϑo·~|b|+ ='Zڝ5S4l$U19rR\O0!oQy!g o()W)(7tR K;{+>1`Y<">(/SF!׋8˖ʬ@ -2'x*hdh c:*gȄ5hv1% sP%FU2%?Ҙt"92E&&]HQ7|P%IwT{whl!zRATkr度Pj0`R:/(wr%ERQ0Ɇ#93YNLhcw!L'H%xj+7AA2LJadK2P*l;Pap p \.'`0:c&%f9c/E`X2e`bL`a:l+ þŚv?8ZnOq6 |>^x ^7Kx'ލ?@(:)@DBRb1QAT5D  ސTRd0d#瓋ɕVrH%o= BR(e&%RNRR KyIRu`~`ޒԅԕԃSkԇ!OТh\Z>VO;IN륽VPV0QpVVHQ+*T)W8p]°b"_Hq+JJJ>JJJ˔6+5(S\YYLC9FYTy!=oT4TlUTRUd*TRN[)|*z 5C0%jF#:㩪*[ujj+jjVjj\jjjԆ5՝ԣsWWާAӰki8P4 i~GfUZUeAm iډڅǵu+Nj:]:outٺ u_MU{_Li`kc`9IZ&&UL:<'C0pn!#c#3F:ƙOhL64yf̳ASCPS.˦ff ff+o0o30aQbq'KEKwK&vWVVIV˭YYYsX̷߳9:}r퓯.Bj+vn5{ؾۡCcc1ǧS,LY;}{ +~:i89:8lsv9>5x꒩MSM&cmM.]\tus6YmscV7=rm-̇˧ۗoׯgs#dv&t:kt< $C+/i%m zl| x0%daȩPJhx[#S s [v6\%<.|k҈g܋GQQGC5)$=N3nnWMI%%&&%J LZ=sE3/%$Rh)))Cfm՛Z5zv s d9>Wu.w4JZRw(n whg޶y&?_#X'x./'c}FOX%ef|7CvRf8K|680NR.9Ai6˛ה>T^HzȶhEѣ y JLK,b/ڵ[|7-] endstream endobj 17 0 obj 3367 endobj 9 0 obj [ /ICCBased 16 0 R ] endobj 18 0 obj << /Length 19 0 R /N 3 /Alternate /DeviceRGB /Filter /FlateDecode >> stream xwTSϽ7" %z ;HQIP&vDF)VdTG"cE b PQDE݌k 5ޚYg}׺PtX4X\XffGD=HƳ.d,P&s"7C$ E6<~&S2)212 "įl+ɘ&Y4Pޚ%ᣌ\%g|eTI(L0_&l2E9r9hxgIbטifSb1+MxL 0oE%YmhYh~S=zU&ϞAYl/$ZUm@O ޜl^ ' lsk.+7oʿ9V;?#I3eE妧KD d9i,UQ h A1vjpԁzN6p\W p G@ K0ށiABZyCAP8C@&*CP=#t] 4}a ٰ;GDxJ>,_“@FXDBX$!k"EHqaYbVabJ0՘cVL6f3bձX'?v 6-V``[a;p~\2n5׌ &x*sb|! ߏƿ' Zk! $l$T4QOt"y\b)AI&NI$R$)TIj"]&=&!:dGrY@^O$ _%?P(&OJEBN9J@y@yCR nXZOD}J}/G3ɭk{%Oחw_.'_!JQ@SVF=IEbbbb5Q%O@%!BӥyҸM:e0G7ӓ e%e[(R0`3R46i^)*n*|"fLUo՝mO0j&jajj.ϧwϝ_4갺zj=U45nɚ4ǴhZ ZZ^0Tf%9->ݫ=cXgN].[7A\SwBOK/X/_Q>QG[ `Aaac#*Z;8cq>[&IIMST`ϴ kh&45ǢYYF֠9<|y+ =X_,,S-,Y)YXmĚk]c}džjcΦ浭-v};]N"&1=xtv(}'{'IߝY) Σ -rqr.d._xpUەZM׍vm=+KGǔ ^WWbj>:>>>v}/avO8 FV> 2 u/_$\BCv< 5 ]s.,4&yUx~xw-bEDCĻHGKwFGEGME{EEKX,YFZ ={$vrK .3\rϮ_Yq*©L_wד+]eD]cIIIOAu_䩔)3ѩiB%a+]3='/40CiU@ёL(sYfLH$%Y jgGeQn~5f5wugv5k֮\۹Nw]m mHFˍenQQ`hBBQ-[lllfjۗ"^bO%ܒY}WwvwXbY^Ю]WVa[q`id2JjGէ{׿m>PkAma꺿g_DHGGu;776ƱqoC{P38!9 ҝˁ^r۽Ug9];}}_~imp㭎}]/}.{^=}^?z8hc' O*?f`ϳgC/Oϩ+FFGGόzˌㅿ)ѫ~wgbk?Jި9mdwi獵ޫ?cǑOO?w| x&mf endstream endobj 19 0 obj 2612 endobj 7 0 obj [ /ICCBased 18 0 R ] endobj 21 0 obj << /Length 22 0 R /Filter /FlateDecode >> stream xVMo1W ͡'G @ Q5B~$W͆H4jbxfg<>&ZjA聦kI5Yk187\h ސ;ߖw B'DCIkqTK{z1#{vOL2I%}aBKj^N" ޿.O>:]lw YWM1m>jCW}Ŷ'W3 Z[GN 0"KЦM9'*vCЄ 1mЎ4n<xLc\E[yfY|S)U_!}s{yJc&K2Tpjԃ%i]vR22vj Ji)gKxˋ ap)Ncd>CRHƬ*_e|:n#y,?NXҫշbVӪ*Sէ5ui~k*ܴ ^؎mpV)`Ó4i˽83JJ%[;bcT͑!QIҤQi;-Ȕ(ilʑVUO9B̌Jd-5*&) 4O5ۘoKno;.*w v8yEI `#ƹfy,z^kےw1ؒ -$T6<Qfd,'*o[}WQ^Zhqvb#vj} So݄C(KL6E{':eWO3c>u=|ûg:2{D\9(JixZ UlBWCad:Xaf endstream endobj 22 0 obj 891 endobj 20 0 obj << /Type /Page /Parent 3 0 R /Resources 23 0 R /Contents 21 0 R /MediaBox [0 0 595 842] /Annots 25 0 R /Thumb 27 0 R >> endobj 23 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R >> >> endobj 25 0 obj [ 26 0 R ] endobj 27 0 obj << /Length 28 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 28 0 obj 1597 endobj 30 0 obj << /Length 31 0 R /Filter /FlateDecode >> stream xWY4~ׯh<X/=&T" C\i_9PSZѭ##}M]ei?@/n2w.}mi뻚*S鶴թł[%񂏼r5Trz^՝;.^Q{ PrC7npw-_i@`}Ezh jZjKgMn Pk3 Xd|F_!o@0?@{-89rwبDM6!XH~D DL0TyqItb Z)D@,GǐnkTQg0GqV&Jd\U p>"hhdb1 {:/M цsHź̿hzبsYu=,$tT|Nu9E rAivTw-AhD@ҟSDØ^1dVPLzR%0m[>3$ܧSa_3 q~L^-d:ݮb43*q U6R'̼{E_.3*yjt{ҮizɋCNd3D6d )Rh:0] BI4z EkB &č+ېc}݆:uDiA\"2Ti+VY̻zKs̼[sQI5dϑc;Ig#ur7*h];&axM`8d1|)0l0)8̋i 1ℳ.s.'#k/w *oZJs4؃LW $@PYr[v h97qNTHrE8W KxdˉF) NiQ3 `iCul웷CKgzyJǡZ.kݴeK.m7jXنi29ڧ˘ e.>% endstream endobj 31 0 obj 1103 endobj 29 0 obj << /Type /Page /Parent 3 0 R /Resources 32 0 R /Contents 30 0 R /MediaBox [0 0 595 842] /Thumb 33 0 R >> endobj 32 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R >> >> endobj 33 0 obj << /Length 34 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 34 0 obj 1597 endobj 36 0 obj << /Length 37 0 R /Filter /FlateDecode >> stream xے)wOs"X"\_у1,6F6~!x!gMWfvEC!hUJڭܶݱs7{U?o^OwnmvMQ+Vm)띋& * ?VmbU6ʦu^߻?>w}Unps7,*ݸ^~qO?w"˿{_hqw?Gowmbں.P)=S0]W(^#n@^!sb$Ku=$u"Q , :tq)'#wo^+zlO3ZY=cS\'6d1Tx~:L?eZ?]){f#\јiN rZ/xgJX:It9`]^AZ8N{w@ Oæ|xv$YhC };A;Q$23ܷy /d%Z&r$2F:5M6ߋcA}j '|m 'T@stXv{1(řqj @30ud9"`} 2L'*J {bG*L-^\Uq{,+sI*.y &eTNV9aR: M)BDEe^ܡcx&?͍+ljg5r`"Y>vjMB0,V./")_Ђg׻Cwo-jx^#XN@ϐ' :iAddi,l9ds.D7nPM xU5nqA]sӧib% Z6,ЊHG$J\ս&a}ƾ,Z0Mp}{$+ʡ! E_S#J(c^|_PBkI>i9BhXE.ZeQ*:A:Pg V.NB.2n XCyIF`ATtyWÕ4npc#w-#qqqٱ9@R* $K ox-Kd(Yj)R$T-8IQsm1;z/> endobj 38 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R /TT3 39 0 R >> >> endobj 40 0 obj [ 41 0 R 42 0 R ] endobj 43 0 obj << /Length 44 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((((((((((((((oo|7t,|;kv=, -mӓ;^cZY#[fdɧ#@(p"I8%qTPT-3x?KvW?:`oϵD$ߤaxF̪[C0* P( Bʆ,̪7'5 Ʒ?|D TӝaqEyD-ݼ#;cQ,`~kEZu>_p4j3yOQNp@( (̰,ecv k u:G1ټ9^Ztljqā-qzE"yמU4P((((((+L:Gb"~g (62r23ʵ?^@xMu#A(̪ A1@S|kBw]2g9F1 rx=NvTPx.U+ O\tQk0Gc %{HW|lWҽZ p-hiD#G ڻ! 9^ y5y#uckw.gvTY턥AGPmoVt$z|sT~7bIDwQMn 汷ҟ_q?((((((7Wڜ:<Dv"[qb-w>&@񏈃~o-$00pTP-OxsfagPP/lz3׏iD%%,Ap\*780G5o(ܴd]9gRĚ/,jtf-8`I;HڶOG%Ě̛KpGPc1X9P#F Gj٣@ѣ BX.e;ر2<p(yIɶ)+QR3(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 44 0 obj 2650 endobj 46 0 obj << /Length 47 0 R /Filter /FlateDecode >> stream xZےH}W侩cj]} xag7YXqa$J#f[ǻ2MGhI]E OnqCtQV.=i{(|O{u88qOxӘ\8Zujӽ!zY^MQ: X^7t j4^o1j!OݯVO?Cvl)7ίm囁t+(H ]-ON gTMÈzʒg\ҌAo @t$-oKy})v:Lo߾K%+|3d*a$ j ,mč(IYPq]YIΥRFy2M&(W*m V94H/%-6v Q{[e{F:5*Q+ h5~2w"Ŭe\mgaQ3՛C2yẃ"{O[-ߟv5 4Z q4aP8؃$I^SbP[}-Ieڌh(2 ƃĶM1s4x`v6F%]6lAXy>C c I3;*6b|X6nX3*#l> ZNX"tmilkx`;[3 Mju >ᇢ2F; A' uJҐ e|Psm9 0̝gw\-:4cZՓ-E>THn",  6e (kuk7. >ҫ6$v@rOZN#Xqk{؀rcT BI(]Tvsܑ|ڃYU730ߞ?h\*ԓPAٓEarwҐ j-*;fiCMfh]1? og>mTyk4ҳvwRdS_ûII"rTŤt3O1uw?&'zv*<ԼvlwlY??wǵ٣mEs2W:t8 9x=}qvwzsR-tN&=ݶ OS[U%m㞎/viUHchi˿򘍇zv_':jͷ D:}VV=nE-Y=Sv<d"lAR1Rf5n#YL,:cufThH~Qx$ɨ@GS*V|dv> >] I#сmk vȸyZUuF7*z0яԄIr4Ew>] 3VCzTCc@#D|DǂCa[}rHQRWCJ"on#TIŶgz0I-ZT6C>-i/R ;bŶ?rcgt2e$$kx21Tݗ*/Eļ'%= `: gT1q]7b+L2v%cȎyN> endstream endobj 47 0 obj 2909 endobj 45 0 obj << /Type /Page /Parent 3 0 R /Resources 48 0 R /Contents 46 0 R /MediaBox [0 0 595 842] /Thumb 51 0 R >> endobj 48 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT4 49 0 R /TT1 8 0 R /TT2 24 0 R /TT5 50 0 R >> >> endobj 51 0 obj << /Length 52 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((8V@]2g>O>9dZLۈ dl 0:t7?xS[a߆mfN;duPQ^Oqmd.lٓ"'wSݻʑ oOA-| NYo{~'x/̵I$Poy|zQR,FBB#uI [>1Sz}⯉~lg8YJ݌|qԌ҃Ɵ_W̋cjvc0-scWxd2ɏa[sq=Uh|@q} P((((((((((((((((((#QnG,+`pqޱ}f`۰ BN@ L#PJR;m7AF#?XG<>ɽ5wR>YUf8'V%4P51 Iip Ң]ѥ&#_!Y2qxdžmEp9@VlzƓ+w3DpxGO((((((3y= ddH&[.eA^X.sXAYf\3ǎO'h[ifq9>ZABBM#I4[(# >JmCxOPJJPt85($I'gG#3#v8aFGn(1|=B&@ ^f;N-ƉawdFg 0H'8j>nb"8竷= i9^0,n_!2O'V-dZPCxo9Y9FFrs4(ܛPɱ$/ + g#c|G^sާmdF 4HscV뛰mm篞rzK&L[;t^! pOq.0.6mӞN:>(((((($OՈBPf6dzC Kxg ʽB+;~ ͹֭mreUoM'"yvniYLC(E4F2sAWhVIkv91RÞ2T^ PY{ia% m,w8dR8ϧ9p ZQ$Cx aWoQi[ݮdHK ݉ժwvp3G$\o&л$*Kr{PlZ$\5I.`3S\jФ4QU^ ` n 1xiNk;\G) r=ڴ0`aolgo ߝ+|8[g tBB%dMco>n1CeGh?d9'f?{6e ڡ8'T3ө4nkȚY% ,7099A&gC;:SÌ2(?L€?((((((6XҴ7q[;mgy!qg$P/iUu+raFy1*+3sIv 0/ ƞ`"[p:gohroQ.)9'QH #;$XH8'm9ϡC8BhHGJV/1Y4* ZТG'>ccsPx8G9')Ѕ`s׿@B4)D,P0ܸ#=3N((((((9bd1ʡ?UG ;*I @R2GBڣ,/pfVeLS $l^=:[v,|^SY(h2 UU1)U p`c=F Cm (=Z(fY'dWVF [P{Ƌú1mAq^d:[F=L0r3Ҵ( A> stream x\vW\<.؃ ¡VjMu}f>( YEl[>j<(t7QbS, YJA6}"{I?u3q9|Q2_fQ\'y4ӥ,׊E ~Tu3uY#Yd8u*WSQ׫U#g9 UDͦQ0l>"[v7zS|*wF7Rn:cA;^,?쮫Rr_׏TWʋuy)2^}ՐztìAŶzy7~wݗ*Fr'V.wrSbݏ# 87WLgcn,%uOu9FjQ|l6rVۋrw~A=v$/GZAZ{&:3DiOehPkuH+kbQLP6,)L`>ljG$VAkd`ζl ăv'P7uI娳Ŵuӵ;k峞L̫+.{iM%d$,*1z*9X%3ӑ;2TQФk`o1KqJYżtlͳ5iˀ0v4T/ :Z\/k 6V_` L~{ XD,1Afx<ɧl 6)A 聢0:ׇ(I W5ǡhH|Bh;ajK0:,$,TѱBkgΛ 9Ae) 6'tYM5UcQ;"8I^ xgbaE$O!婮LQ_vFsu-fRuV I=0U~b@H"Ҙ0/L:%SgmB˳)DOeޞ@vJȨ 4_w:&"O^f/!wdD̚Ֆz"Fq`@&r *ӊ44΢lQ>W!<^X nwVtrY ҧtFvp5/ݼ*xMa6v\7&"b x#wCA 7؃'8D !`pc|je]3"8+B\ wӦ03$6}$Ţ=x+U^8D]C z1uQC""RΠAm=XcCjhrjoE M?hك ,Yy€AFCB|XEcbָyQ4l6`ܖ#[N[kQĿ GK-' ifE tޫCvʹ5E3f$ca0c *AٴW8V(Jwi5L@HRHv6C`M;ȬEg}EG/Gh 1TI~ʝ;3n m^Х\R [yaCΖPje4ϴep`p .7VtQ蔟4}J-ۇq5! >s5&c,ThBBU#?OӧD7jxX]،FӛNwc|`:HVn4 QK3~m4;@Y =:qWoGDr'y0gD}RLl6 =>Y%qCxYdJ]dbd6k^JNSP_zWݣѳӋ*Wzf[l"tmr.sJ#qJY_uշ']^4|ȮZQ/u)/Z.rJ,q-7zpT:="㠾~Y7$cZ5Lvأkq:E-AiyDr=\j2cLNʚ,BAqAo:c4'NߠGwyS<8m=]xk8t RGAx`:I$p:yn+(E~h߭g RJK(2#`Z=Oc Htpu+Ws0 \-|#0Vya$YtD_Xl:MHz2ӊ|̉x#m=7_}}km2w8'$ i м*uWgZ!"*W5D$Kk|_j8)m'_aSke ٠5Y@mb<]U PcV-))Zc2ƞmΎ;׍PEĴ;OѨ,+ h6eqbL @|1 v19HD:|Plba "FނE@|n5|Eo9BV8h=yrCj$y/DLi2a6X6QlPNaZ%6h!߱ !6%clwE6HRP-^Z.ܜ4ѷAs~N9> endobj 56 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R /TT4 49 0 R >> >> endobj 57 0 obj << /Length 58 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((kE|EM'۽d`B9k'\t kF`gXaA<ӿD<G%bcAVf9{Ac&%…|:q \ `c ?^S[$S"\2JK!PjqamqU*Nsdr@x$g|o6]Ciɑ$ǽ̜29݂?~:;~v7y{vyb^~NzVq*.H$`f~-xٺ^]bYUسe+N=:@K YwqF(c d.d +.;pNI>.# 1d9\P `Ӿ,xW[jfDRìed5)qMbrys"i-s oZiri=] C̹pv#;VlwZMiAqxH*PU 0*9~5|3[k+ ^[E)o0FI`$Oka`#< `B~]_ _8Ey>*Th[ 돗sco0YdjdGᑹIP`[ ֨R4k_Om*T -ȓ4LdcV((((((n[I)OFu.ꡗ?OEgu<Ŝ(Rzn?8:0l]D ۷'sϷOzѢӡOݞ8?sӎ,:ٺ#OsOzѢZT!f~luYCEm1%pZ#:r1@TUb" uA:!P,do?jY? /=jO/P߳P((((((n+k"'fR}@+j9n0WjYR1yG| q!DA^#'v'{co~,fbHQ2~V?Sq6Ӎq@!|fܢ w=Ԉ}1*??9YFN]pG/~v1-7ӶÓ/=!V;wݿ<`ss鎜ն˘K]'v@$r9k ؒ/\<8{OXPs2FH@1q>:Ǩl"I-جE{۵V mF'C2~Fu`ZL^J9L}PAB[Qc ,0>%n?4gug*Y\'޾NcZԿ@((((((.m㺅Fxe <@j\˂I19ɤ:U ۟I#7zuyذqJA_@,m~ xzϞTKZ. ;<~nz N~ş(B,b+fev4c~{&c"$O&~RNݐ9928~9L{r{hu`Y9qPo69>>W{_Nv"kI?RF8zOGCgNsRIٻIa0u=1 u=6ӧm0}<~%/}D|/g]'h]:e3>ֹ'ilg8=@OT?Kcq!_O"$=q=CVW#g$I'c۰aII788|cj/_|Ss?/UY]:P4`̧!?5#Gˏ9@((((((wZ~7y׌\1=>͋۳h퍸Ƕ1P𩕇'gϗEsXAfY@77q_ Ɔ'&9[6~^caqo/lm+( Җ9XO(ـ6㍽䊠]@(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 58 0 obj 4476 endobj 60 0 obj << /Length 61 0 R /Filter /FlateDecode >> stream xZm޿+ƞEqQ"AvSlR~eRx< !y'/䝔6ҵ,Vru+Uw{uHs7nŢ4b4RWu.[Iϥ;`*ESaXIz\fX^~M\w{UݵER'r/fF?(2-Ҡ/䯲v5mb]k,*Z%m*kD^!VelI6Tu쮝 H0: DzS+ϻ $o"RیV9eҋ`u8  r%c(W6;f8j'`[Z$=hTu~(7*”< ^6[d~IoM7`e&P#Έ A<ۄU(sj7=Ӏ Q%my6 Oi9c;lZ̓:#ڏMt3Q!P :9AGs6Uv*, hrhy(7l%?$;B >xveIBo[M81GN#Zm7*U1h"_9^+۳>ezx1C#2cA_૙LGη}~dl`SPoh t+ h 5PԶq5\X6 3 1bz7ua2a[f!ιͦv'QrN$b)cƐ5%[ J Q4>0[K3 Ox`6hC߄pi0Đƭ`!Yίs^Aȏ%uS1D4F2G4 Y70JBo%C)ioBm#Nč:u5ƯsQ\*ˢimh̐'*By5$>/[`kZfA`W yX~T-̃ HP$#IA\Tjv 2g_YNa-@CĄ$gBn8WJki%wP2h{S^ +=F&r']DOײ(h6+^ߢOBR7 }5/w L]j⠂;!8txl?|s~l- PdDzoe!Zd(sDa%1ayK̴'1{Gh<'@s̹ȳv3.e(N/ʢ,KPFJ :^׈F.߿~7W7on6یrCB} b*3k`K{ lFlQ̎m6_LFds8~_aW6h1k [ˆW(#S~g##(C#v0:M56C'5N:axtM,\SB0|5L _f8C@Ac%:BAgz:)hhhkZ賂4{>i7; Bl5}wA׶$`1$O_µ-To&_qưw>ۻADpPB9\mAא"Imv[qИ6~ފ7S7 nTo6+ 2RQC[>VӛnfxRo3m=LK-HT)ebaIuy<Ⱞ?=p!Gg|KjnN%",:SuSTO'Tbag8b7< ᇮz_=DةΗ8~աI4᭗s$\ $Ԏܡ?.gy FQis4E 9xPGRW0L8lI<$[F8C~4?2aBv" ):0ԸV'y(^#R)N~čHh[o4 $+DԨwqċϱt"^Po"]r~"z!Gt2tH`B֍$ 5l;P'hGgq?*ʬܼ3\.7L> endobj 62 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R /TT4 49 0 R >> >> endobj 63 0 obj [ 64 0 R 65 0 R ] endobj 66 0 obj << /Length 67 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 67 0 obj 1597 endobj 69 0 obj << /Length 70 0 R /Filter /FlateDecode >> stream x[ے}Wt*zL, ]JlYC(r襵ji`AK2GA{cB 7%4C*U4Ow̫G$lyhP^#2C'&)À(?MJ 0^iX]/z<s'+W4ߚ}ѝ0S}q? \*&f-f暺_i7z3f11qQ{#KU ##N@l~ ,a#£7ˍ,%@w>ZK-(+-T<9^8H8NTHGō'10Xe[Ȫ tT^HEP_VѨLI,eݕSZN0jW"v_JKhcFm0 NCDRZX+Ow7.)1(wy蕈Dd[hwr\ ?. ކ 3MG0LmUoihV\ȯ? nX'qֶ4Sr`.Wf-N$ {T"@BF'Td),n>u50WV 6,7%4"Fd9bLR % 4@"珶\s+E&  .@@k9VZZwCQfCD8;AnƿQl_qZǾU%(}tOWYg]fˬƧANOWDnlHs| c#>OcAoWI9qo93\daf@R=oi&VT7rޮ؇dWN76rsjUWT"O|1NIv?>fRP9NV4[âanG*uKÓo*W_ Ѣ .L97misHd? lj|#>'8/b4?~RR8/}@6͔O3}5ٰ՗./Mq^/ (>j*whz5-N64_rm^ŊRLB~8:9+ GO{0]=Td `3/d,C} 3d0/,S5a]4)*K{2Bq7: W+ T|&O1F^2B% ;#Ld L,3ژu%Dr>D*Uŕ|mz\N)^KbCY 'zI ]\AϑVG$Z#dy74 1ș,^b c OSv!E;F!` B)r;!lͦbx@ -;5BީJd>N؁xq0}xۖ62fYږ]@96_9v_)|Flz_0rykjP; ! YhZRKV9qV'%» OCٗ p !`l]0AqSElrqft#G%{1dB(MlAFlEH=i-UŝfTi\|l@:@L'bo *v3.DiZo:Pdo N|ƉP s}ʅO733xŝ,Dlu``ue3sۖ ηd"N_K(},73Uq`%xY/*(m./DSPÉ,a U Ҩve.XgÒ?  &q1؍ ˨̉y֧U0Kgŝ|8 9<อDH@N.Ȫ:MtE s#}AgoYb<.\A6 C,!ZwuU]M;ziFֹ%7˰HtEH8E+^ٶbwѕr]6G \: vxssҔ D45uB?kInXXxH}H[0*X* u(}E(`ACsZmIS[Q^.Օd%+'3 q> endobj 71 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT4 49 0 R /TT1 8 0 R /TT2 24 0 R /TT5 50 0 R >> >> endobj 72 0 obj << /Length 73 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((mtW)*3nmO]BKIV8ST*GVLX<֒9w S8 㸠 (((((((((((vqpwKiqtjlm*=TV֯,)S;oXHg=Q@Q@Q@Q@Q@((((((剻!kr?s o1TwxUTE]LIf-h۠;F;{V`$a܆=ŀlݑÎuMo6g+}jsfv |#q@iP6_S89?^qP~7.qbll8$gryk py,m؂.FGs]Fb*Ker8فut +Ymkn˶F6* q<0i!*c"#F첷σ\[ K" 6~09>5h((((((((>MN=c SpU1[I qxSIgiL'?5Eb]\x&Y[N#2s '1Yw/cxܢ2&^Y[{[i! & z? ctЩTINr#bx!IsS@Q@Q@Q@((((((^5u$͑3?ڢa!-6O iZ܍#BͶc9Mgk ӻ AN?'LY ,0_Li $Ao18s6^(tx-2(F\-XqHX|N+i$4%u+@ʯ0Y+TO3[|Q2WQKY6݄sd+la:Ti55q jAUM'i$c V.|W+-3 ⲁʛ;|ͅs@=JO!w 2<0,:_۪M)hK!r«*4>"X@P"HΤ rWE⿈qyr$zt`\Џ?t((((((o@ecE+iZ5spI, 3d\xG⻤ 7'?1cҭIcz:]Oě}M.p.h?!hvpXnW` G>Aymm_\l]ٕB␹8^((((((((((((((((((((((+ʳ:n@ R ; s+!KƚG:1䀜y{$k1#oRt [}g8qq1utܪdb̧qא}3W 9"#`%:tS8 &zZ5PۻǐA郏nۢ1L ]Z Jv9!uCsV.-Zc=bFD1tsϮjQEQE((((((vFrT{s|~^[khnl«{1瞃$stƊH2$AN}89=2w~1cjߏ~^ԛ<V?xɦ.ۈ $I2PͪjLs22]^$dPr:p{` ŏE&G"uU:пiK ߻$ʏ^˨^Ʊzd7W(CxV) 8.n>|$L(~n/aя_cM֭p4`p-|1'8_ZHrV mY2 4$Fk#VD1spORHuzskz24);H W-I<SV{$w>Tok1`@v,W=5x ̐ŝpS-r .mHM7OM{Cn-ߵT |=hڰ7 D6{ <\ly2Lcyxܿg$ I;OQR6#\#¦ՕeE chl2XqPA}[C/=ټI8c^m' JnQq֭עW9&Ǧp> S4h9$$B6񵷒~]kG`WNOG"?, 7\?sza:{e<K*jnȡH##7ލ?(((((() 앗2~S=c$sPZZBFܮr2sh%du 9b19쎃z) 旜i;O0g;-{} ct崝_v2NyT`/B?IzvP?zN*CanG;O0;lU' ]'Wh a$T}Id(((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 73 0 obj 4533 endobj 76 0 obj << /Length 77 0 R /Filter /FlateDecode >> stream x\ms_M=(SA ^HB:m8qq䄞|3#&In @6w}{w ~\F!Mv1Dkj?ŞFM/M"iH(p&[ Z.xfE($Y&|Zӗ3.f5ْC\gD3:OצΥ `VBwX2~4]~ٿ˪$#'p݀9|gO=C"XER4u"VҔ:֗󧬖p2HͺT&IJڋXoШ,UlWj58[Z.+tQfM~yZzo!گ6K+Ћgtf~zʬ &.Kob8rb.Era;q-GhȋPbNΨ^kUEK#ej[qE(Nҧv"){hZ3+mKx/:0aj:dB]"-]ci4 &џp|{ {,[V'a!Ks_Ovl=Iw-ELgpAvo>S2u"=&9. >>$<+MGv[G[1'd-Hm3?$b pq^J#Y0=5@$9!;2 JDa4Y ̱$ Wei YӺKur%$sn]ooϤQ=m4Zv]T$Iʠ~㘯S eƚp!;-UQQ!KfOI/]PNX%Wl#:XL'iɔ2F)r QHbN( cDYz'=Urbaos q ti) `ڿda#r)Eb5Rvn+#:ߓ6hiZHO%Nvat"wQ{^v,sTh zKݮݰk|坏GbҜ}.v(d~fgU9{~{kUY=‮ՂFṂ] o>mv"5lq21ݭwݓCscGr$?x}Cg}v,nch^==I2,s䁓{?# b]J8}y%_5zn˥rEU ,b]Tkd1p >YTP5u&":y㎘N~o^R#Ü_?l*v*f[+݌ Xg5 +nf_w7['%ޗ?o'w0 J 9LkT6)@*ս6sM|?}h Pp]:ՃhAC cg@c#U"3J1=Nٝv}&cGqUwՠ]Έ8xλ݊1eT ]GS{=c@ !^Xy:Sv ށ[ح'p]HGJBD7B(95M- :|";pWcA Ս$E}SBWO"E<ʌ@}Z oE q[SVB3'xة@?D(09@A\tƜD: "; 7?h)G v|e.}u {6]aUfy 1ԑ]}'[Y95.`aߩv"s pWcw"sg\/cuJ(@4HIʌ1D#uDwvl%9< x`g!ܯS霑/cuJ(@aӬ[(g+3>ag: "dq8zD8jޣ h:N>'W@Hї:%M9D>ǚ@BD +Gdd0ʚN )A湯9Sc6VxX:eSQ5y@X/dyv `p*O'@!?CEY7a(gV^'1)cb;CU2L%)c> endobj 78 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT4 49 0 R /TT8 81 0 R /TT1 8 0 R /TT2 24 0 R /TT7 80 0 R >> >> endobj 82 0 obj << /Length 83 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((6JKmI>F2O=r98@Glfcs;CcfϓKXMp2 $sߊ.a4fk%ng_\qÊ٢1lI%[qFЮ;6'&l?s@@QGNq*`EQմMl.sdCZ4˜29 'ѐNxMWWPC+rN((((((((z^~-72FWqu~LJm`X+ mt#0O=-G6nȍA`67p{֭4 .[F<۵Oɳ?0cQ629U(8a%(aU@U( ( (?((((((2Oa4W(RyeNsF4.UKPۊF8pO~k^ $8}&z!׌9үW]PN$c'W|s8. d}By.Jkn .8Nry [In ۴l_Wt<@VDpmwo g|az^ʆ d#-.p @ˆy\c6 㞴QYqj 67DpD!{ *zО)۷ʉ.v?((((((ք 5-0ά8?t*yR8Yz,vv _Thn&w-.mщT6R23S>+"}n;x "Bzɹ״KIB#Hpyp"^Ym]{yPw9OFF~[wαaȥ`yU-"k{ I;x=Ǯjݭݵ si & :Yz)V%w <n\VP4'1^]G߇`oLڀgc J6͆Hǘ|tjRԴD1 w23zE]((((((oXoqq}RtY/-bXGOhI1l89uɲt=9}?Oxb4q* gj) <)c }eMh7wsaHr1G(HaKW$14" r2Yh="PdJ(tۏDv&Q?9\83ޤ7Z^}"yk.۞(jZgpaak|nS;Fv]((((((*Dc"I!Z9^22<)P+J&km*>:m`ydU43HXr,,-췇b2XKpG@B ȟD{-! q2 Q«tr{׬U!F q;W{lǐO'tk(Viq+|w ?*B囒Xc$5B:%dQrˈc^N[M6KY澸YvHT GAO΀5+:LK3Jn^x!HYvW2[`WiTAܤ1۸ ϛ4с1Wjגۏ4F6`D>ث((((((mJ]hK4rIne.#px+f ]l,]EK%hl,@@Iժ(ZkQ6#ڼc A^sEES+fIWP-f@jl|6 \Zem]N^b(IZtPT7{AX,t-(U478u!=R9A03tȵxbaCu!#iIH`viQE(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 83 0 obj 4290 endobj 85 0 obj << /Length 86 0 R /Filter /FlateDecode >> stream xZr}W! %<ȖR"[<-j9k%]P4?40sN(*-ez擼O|2Kh_r#O?%=IR;mcv"Jeb52,ɢE΂rX'\>&͒(si:A[˲n_zwo o$ 7|WOw۵A#T\c!?]oL#󵪡J _.CdgQUct%/>GJʻjzzc{ L.ż.c!`{`H<ܓ-MSМ0Ai Rg#{(2GN>IE+ #yTf9ū|G}mG#]"jG%E@bY) FY]q:>O @ |D8bf<Ahɟ-\&50KaP]t^9jE'RͲ/TUo8DN 3YF194O{Og- ڮ{SυXo*YwC=^o7/}eL>_չj=#88|,h )}Vd,5L dC9v&Iq0Œc'#"]u? O t&7e/e|~]t`2vn]KTw',dd;HxYNY:Z( lj&2 h vXKpQWϔtHa= yc:M}DRCX%l-.XB!FY,%n'^PޫC@b>0k;pEx"S1^ oL\cD9Bc8S3KOώ`fz2b-.$D2OVPƭڪjp6`vc(mF:ncXHNԧ@uf9|6`mC6n/Qt1 OfDWtvIG˹6clޜg_DsB*I~{ɾIڵ  :/%<ܠ/ߔA\mh# Z el(wA=ew׈W"<(JkrGg͕ctR>%@qvXxoub/=8m#Z"ʀnw`į7ddQ+6wiGJhbluj]5L ?;Bj{ć =g=bt Vr]S+7w? tzK0h$TLGz`F}Eٖ=lk)92DDt@aDo%QXͣy>C^޳ J!E3I,ZQ銞m *luvC|0Bշ /^G0fW0iLtT A/-fX ԃ*pglթx<_bEX6 hrCf8"ni4Hsd _I3 P' w{=O ]4clvp.R?]szˋP8l Tg# V$B5ZﮋCzFUms3筜z(n)7|x敭@_}28cΔ%܁x \5\FC%F{<6FH{d=ѝvy_jg` 'פ`Ο^hW&i)=Z" 1,PLh2O: #,s\## W{Q`hH=w,5={KP1J#dZ3KEӓ8NԎC)j}کAbh8K@1U?#/Wԧ`AAC_~ ƹCwkrDRT"b nTjm0S{O2T՝՗B_ۛS!wbn'Ry?[s:m>^n?> endobj 87 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT4 49 0 R /TT1 8 0 R /TT2 24 0 R /TT9 88 0 R /TT11 90 0 R >> >> endobj 91 0 obj << /Length 92 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((X6pǠMgA0Rb2 lsqk)|9TTUc L.x8 GdfKXy"l sӃU bFTo;&HnaTg)[xrУ};FѕkE%xF:yu[ӣ!,aa9')<Ɔ1%`@G'9J%ׄonc1s3?@<=[t{t>^LtqhKVU!GFY;cg`e7|}BqSy!VBatω6;A\wp9 +Ai8%w@!1p,*/Shdf݃e`cמQ\&_Zyi29ʝU |x$hNF'NhvjF<^*(IVr3#4((((((((((((((((((Ig%<#XEtGܼơ߃ 3 |i[ѾmUIur6VۙpMz|pD* T x$gǷ`Sq0!&/Cd<`(ɣKxc `@G,[#P|0[Rd_ e@#Wb*O'&X<#.o _P /.RH (̊'$}&((((((((((TcӍ)"i< @x9#ץť)1#ľ[#6,EExɭfX>$<戲Xgu'ОqZ?M k,lZޒyD89UI246S1F*Jz3?~'(((((((((((((((((("Y+ Fp΀/\ۭCu [P[N0*˻*PA鞙h # CaXˮgV(;X ϥ91-lRam@F\ıiܒFF;CU-2Ec,ZZ訠 i5drU$ 0nӁ98HndSEX0sᑌsuEak, `fg  s3|^S?fݐ;gx( v9ev128Ͼ::Տe[׭Z(((((((T٭E}r%l`R!p69$z w1au&VJUHs@UM2$|'1EZǓHcظr 70"l3/xl\V]R\4W7ŝ@[G~ݦ7_b8"?O!SQLo-z1?7rI9/ܩzD[ (^[0N\rJrWbVB1/0 7`94WOny偼)6dabB7"̬ dK˽Vm,Byw& 3Q y=r+vVw\-盈X)oS<c9_xP(((((('R  c>〾I n999[Bx&9cwк ЎD6K(-i~5ڤ\x4RSejTڹXt HT2.1`d*Ey$6V{` 0KòEl6`d6pOOׇd4'mg*}"Hgj:3GI-c24l6c j@:s]^jU0щ8pqQEQE((((((((((((((((((*Md] 2 Vj$a2cH;z>n޶  ,q݄킸psv9D 7H&-VGg@=y[P,U`\n^F+i> stream xZnF}߯E*CހBB*Sȱi&n?^,WZRtP:3gyK/2ۚ隞|urw;7uZTM]Ѻ-Ӣmj*]gEKTG 2oye̩yrnyuEI}=lrfOPr}AYS=6zGlJu ].W|GlXVvҮZgi˂XЊEϊt]5A[qU9ʴ͎Z#oDHb)*(D vmѸCn e,m!c gf-2}f65̂3Dμox=rBY\_!O^%x$ZDN*i0X(?ǘWhɊ3G{{41qchJ <`Mw*"iǎ佔v<+F~/aJDdg8S|~D/ֻAfp܏gsT Ǣ;q`1/Ka0>S `&`=@TMC%/YcjiZUcW19iLǸʳd:XyrGrAlF'p vCAn lxivK@v]:ziim]Di* {N'JG#HcPIl!CD"ئF39_eiL)KZm1z1upӃOsYy t6T18Ap:Ijʮg{LA'L vBvvp\biNBm^eikyps¯c1qy$O9 v'J@\#*Hf/Hg~({̲`Ʀ+\ 󊊭EFbM$h :Vjy~ׂ)C֒8`׉%:C1SH1TPfGCuz`rjZm$X͠ZL # O.PIQiCP& (#РWUq62 \RLUY=cSF/+=p-y0}@~p\m+ %tqzL=55`nWA\S柯k,7+]Qv] K]]sc hw}siؤDshq ܻd^2n|Vw5I*|0L;G$[L3a^ ǗL]&<}iAna,@gHPX3yCLoSRm;J8@i\"@_P 2s1.ˍHՅ̳k)..`O7ƶOoҠPvd:lh3OA _4)̲@b%bE ʊM2$A"1"^8DWݝ/g3<_UyPUi }䯃O?*?jȩe|o\n乇U endstream endobj 95 0 obj 2190 endobj 93 0 obj << /Type /Page /Parent 75 0 R /Resources 96 0 R /Contents 94 0 R /MediaBox [0 0 595 842] /Thumb 97 0 R >> endobj 96 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT4 49 0 R /TT1 8 0 R /TT2 24 0 R /TT9 88 0 R /TT11 90 0 R >> >> endobj 97 0 obj << /Length 98 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 98 0 obj 1597 endobj 100 0 obj << /Length 101 0 R /Filter /FlateDecode >> stream xVˎ0+;Gb84 *() & mv4A+>npE]d;\ r36˹j:TqVԶ@q)*gfR K"7MRPβ5}߮Q o"~lZzpwKWZE?GEx%"è`SU*Ѡ Q%šl)7 2<' ~DѸX̩^cE3A"5ɶ $>І[?;l(?MJ't, D":%+ol J-"hQ`/FꈚꄚioW}),~yMkݿpDI^t}kcPH$_pW}ȈwA+$ƛ'SD&"|gy:a3fFʕBZq?]FҼn20 %!eadN1c€ q\7<8W:ދy^|*(Hp]EBi-}}E&p'a-#iW ViepNRՎT{-wVG:hfYNvqXwP0@^};H;35HBC"80l1܍%?%Vڷ 79i, p.\Dh87w &T\oAGd[?[ endstream endobj 101 0 obj 709 endobj 99 0 obj << /Type /Page /Parent 75 0 R /Resources 102 0 R /Contents 100 0 R /MediaBox [0 0 595 842] /Thumb 103 0 R >> endobj 102 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R >> >> endobj 103 0 obj << /Length 104 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 104 0 obj 1597 endobj 106 0 obj << /Length 107 0 R /Filter /FlateDecode >> stream xZnϧ&@A6ū(:բ(HjKr(:o}y7/f6B<9}/I2P1HAwl eSE^-K0#s3/\'2͘J-0|GWW;VjC"w?# };{s.q>ۚco8VOVɜMһZh"2E+)f,b-9a DBUݛs|0GT~1i?s`2 pA/9ܓDZ{&llFaeFgGc`al"胠h *o!IΔRj2 AN* >G3`mv q`]hrF4EE!f9BV7(R뷕b|VagPL.?+WL,(8,hwȂ6 ֶͧ[Ήu-b/!rJAiE8(X ue,tX$"pC.̖c`"wi`0sS`^*Jة%+XL`8dOg`H:#g4ݝT`I)4'iԆ2Rs4ThP1lD2:AYmXRx(o2MlI P B-֣Q$i 6Rj:m+J-YU%A_ nӌףNV?(ʼq/ (A~,`;;/ B5$uDM!@ʡZp1X1 0?z*8yiԟ5PPa;F gnmFɲJuy&I/.oAB{QLj]SSx(*\-ȾXNϊ aԅ"|`0و*! :>n|Ut* !u;2DM/PmcQ X*7R #(Z6`(e,۾7x&=S׆<ϒ}}r]FucFo?凵Pyy(|k5߯7š<ȿ[9(G<@ Q] ȵ&ڣLm̉pe*NrWwÏW7W?rΐ~TQi0u ^vf3`CgzPCNxœcGR^.[awr3nl85)T34 1N:X|~#B=xQSb:X~%!a`3wga BBN]^`q332l: oQN( K!:˞*Z@!Ԣ% EQEK# X T+M{ )yCYmSЮn % t4Iɦ]iN.z>(xV΅"q"=K`F=—"8:Y[eR -,& jF5 O#t5i~y.z{qpCn@j! cs3wߐp~$EzpڗqzLVkLyF))cmiծ9viQ^|_j^c?z/&UaNmnfqipU3\4iD߲Agrq2[ x%k^zj hW!;vgѦ ;*7m N4;W GMz~pmzz8Vyc\X)Ϸf_5~~TůgVċ"/1`uƒQ\> endobj 108 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R /TT4 49 0 R >> >> endobj 109 0 obj << /Length 110 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((((((((((((((/xjpS뚮x$6WfCؔS $|cӾ[O}{PA(WM ݅{vUP1@=N \}z{"H%#[Oc;dZ_6<[mByceOtW/ C3gS:y)c+6һ[ JK`bI*9<PRo$tQðC`8xmNa۝MˑU`A&#Qxiz`Ԩ'? 5xZ'uH)6pLM*K yn1]̉9۸e3z`0{ vuTvS-Cߊf?((((((((((((((((((>RuB;G^ gY$-/ Tؠ^h 9H#G0\ɽ I3U &*3 &xxQ猃[P$vE<(s!vuN+#Ҥ܇[;+nmpQ8éV"QEQEQE((((((׆[X~6IT3}:՚(|U#sorq@]9_*AojmJ>1Ozޢ0o446݉%pvmx$cԬ"EjswmssӌVxc ELB:<%R~V@vP6q0yEc#ɉ"T9G;}Ԟ%a8mfxt}x cn@RIFAlE;'mwfr((((((זwn,[<Nyq\w o|sRɂA lgu梛EoUĦ=wO۟oQ@Sh3$JP*BVEpapcc=8􉣸ItȌO̅N[v ٻEQEQE((((((4B'8M>mi]E.'k$ka?>8y=8<wk;kv`0r:cRM;((Ṹ0KCʇjaYARnrNh~޶od,f?HO(mnwo 23|sҀ6() X\@'V-xnVG[{X} q Z+]j8d6L#`(Iq8sPI;HVĤ+wApQ\96dZJAsE7{?9((((((((((((((((((ڛgIn_uAxYPhs䦩u&s 1 ̿%xD?(;>[A n7&Pgnц,mPCEsUoG͜qlcޞt;m]bՋ̣%b\F09$òK+&z< Q% -rc'3Mon޶ 9(oAh|9#<`c<ӝEjsw8ozڢ(JL1B%w=ޛhua& ! wGpK| /2A;@ ((((((((((̨܅U$-6$zmeg ,PP3 7r=~ЌЍb̝?UW/|ÝBphj*^Z)pӠ1~帷v1@QU>chgx שz=Iw ,QU墱Fmb?(((((("pdPr*ƕݺIug څV*0FG5~>О8Nu<d3]CO4ǧgJEk@'K-wOq2@&m#Jq6< ,Sɭ(.]EVm>I3D> stream xZmoG>ú}B8WMbUQu dm9nQOqvgg_rk13/$|zM(lLYvE??{h@QYgQf㔦dϲ1Q:obj lɈ$ɄLGY'o-瑉h_(;pQpr@Gq~*-tMZw-u ][!9}[w%}zC`-8!Mьm0al0M,`ٌT0.iVL:Dk .߯򣯯VjMYnn9wϾW'秋ٳ?1100p C>a&0Јi8ԹQ\T)2Έ>ŷ"H"{S >C\kŵJg/u>kh fTIYUNr][߈<{kᕿ>ūӁ:Qj;Ow-Q.@d +bXR +Pwk2Qx#V TSC~_7W]4IU!" q)zs\}Yqi(TМЕ&ɮ \al d)$GgN6pO%mM"eҎ4^M$93?0j ǩka\!Xka\9#8@-aƹkY(!]p.p0t-9"WbyʘT14R؏NhZ zőG%@p-_+e/u:SUl`C`x>D,Ś.]g5Mc @1XX)}a<<*<UP? cX 5cw8#sl+4:cmF NSc@/X[Ιǹ+\黢nWvd}3.v!f$;2PĿ^}h>W"b:`Z8sY2Z୚=np(wp.wҦJu=Q\S%;^h˙*Q:hGQPF`=oP~ Kbe#R1 S)qDJamEh"ZGpҙ-*4بr"V p?szU(O(O.jӱWp+~:ҽʡcN(@BM `ЀD:6@ZD ڷ){>T% ^h˙f l/eQd- ~hyhBPjD,P:ls@-)Iƨ'%os.{c93w9%I[&{צ~ɼG*ӈ?ϧFu 7_ >[Kѩ'S @D)bB,@܇,S*$XC5z7Pz|߭tOC:Ҙ;K񱝀ߪ36:92q&鰚$JW,T&,0KVf/*&K%T7p:VtDHwiK+b-5OasxWԲrejz]p36.Fd*}eřmqD5r 8X7GEZ !KMw*ڻܮSKzr6r ݖZKSiOSzCT2ӆ^mp*e.5c%`7:0/܃>M"}1qay} o Ku$T}Q4H6|3'AO`;pŎvbAhq C&` da7da:6#>O9Ʋ]v vl,ܴլZW;Ø^t.y.XufP^!Tel`X[2uX 13K1 0CX 20wPܣ1n endstream endobj 113 0 obj 2654 endobj 111 0 obj << /Type /Page /Parent 75 0 R /Resources 114 0 R /Contents 112 0 R /MediaBox [0 0 595 842] /Thumb 115 0 R >> endobj 114 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R /TT4 49 0 R >> >> endobj 115 0 obj << /Length 116 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((((T_Sx]o[}}gn8ӬqiD301۟qH;\8#JCgK'r0>^gpk7@ټ{"7uVO#lկy9-#*~Ҭd g-d)Yc.s2I_DmhGV i At=qQM7Gomn#!sLH29N\1ӭ_fœI]N|NR э ۘaK!FW Ųs9 +[p1v99GCڤη((((((r+#JZ(5ҞkK89ͼ-(]3=jA ,dy+m(9V'riہͤ9}qyc42F72<;l89]%Gd4/-n˂8 t<`Ukcrmn Wvvx힙ⶨ~ my5÷n[CG "6ںJ(((((((4@O| ~EQEQEQEQEQE(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 116 0 obj 2143 endobj 118 0 obj << /Length 119 0 R /Filter /FlateDecode >> stream xZkoF> Щ#- 7$źdڨ%G~/9si&@t33ss|F @6|<2ۊΪkكA'Q(Q~tߞ0L2Sҗ0҇rtAГٍ<0odzxI-]֏v ,sn q#B-ˣ?JA6[/zO7{zҫ݃b6G ]5%Ic u%F oG)̲푱&%& &rG2|)^q/>A >A,~qw=RQYM;R엃= t7^)7 pk FpJ`t6 ÃU/IR϶BmiSLBHgV28RS)gn/'X^u jpT0lŲu3KP}V^)bkxʬTq| Mg5<8-8(KvMuDu:NG*? j4h K5|rܔݡ]aX|5C|N 㽅{q$ET&߹6w]e%8E9B9u 2ʼnxR {`E=UJ/F/9@G.#|Du G[qƼ+NsöC҃ 6i&6 '/ΧX^__Mg&Ww^-W읝˾'zYi;\~~J 2؆7jL=mlG,T'EV5lO?ê4>+o45o,2]'D(?Tj]?e式[[@)BW?^zec-OX}E *GqpH,`8E%Szlװq1_e ><qOl!ZGTI?aAtrWL,bw&ǵhGڟ%ZYpyT, Z.bٗtng? w~AWިtÞ|X`>[^tظ{< w\@ endstream endobj 119 0 obj 2414 endobj 117 0 obj << /Type /Page /Parent 75 0 R /Resources 120 0 R /Contents 118 0 R /MediaBox [0 0 595 842] /Thumb 121 0 R >> endobj 120 0 obj << /ProcSet [ /PDF /Text ] /ColorSpace << /Cs2 9 0 R /Cs1 7 0 R >> /Font << /TT1 8 0 R /TT2 24 0 R /TT4 49 0 R >> >> endobj 121 0 obj << /Length 122 0 R /Type /XObject /Subtype /Image /Width 181 /Height 256 /ColorSpace 7 0 R /BitsPerComponent 8 /Filter /DCTDecode >> stream JFIFHHLExifMM*i8Photoshop 3.08BIM8BIM%ُ B~" }!1AQa"q2#BR$3br %&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz w!1AQaq"2B #3Rbr $4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyzC  C  ?((((((qɬ N[땐̪ " )b8FSNg+0Ku]EPEPEPEPEP((((((y[ ?NFw#ݜeN=3؟ZEPEPEPEPEP(((((('$UScRONAiPEPEPEPEPEP((((((Qu 9L7 4Lrqc9⑵C̀.NIp2>^zڢ15'WgM }P˩吪?{xkz:f&_Bx.lO1c"ڦJ2clq] 6~E,BdD!˝9<ՖF}GpɒʎO8= (8]$t1%[RGC2*J(((((((([jgv# GcYPxgI$QW$AIЃǥo\C@n;IΗ8AӠ[;fn%~Nݙݻ~vךho-*f9\ɓ;zvz-Z$ţ_:A@(Mh\6E ۦ1Ѿ >wͥg>$d+O$dy<t=F_12ڨ39-{RVRb9%w;Ҁ5(a<)l63=>jODo'@((((((.- {R3t\uLvڨjkN) CJA˃38 vڌyWB2F [89b8^"+jDc†Sm!HbCcޑ][:<(;Ls'̹*E Fv8w*9#,98 =R2.[G:JbE7MHB( 1l.Ar2ZڦA&*D7$r>wh;]i^o67GG(XQOkmYXE*bPcA<ڵh -XfemPU9#-1kZZLXnsOoqEaeRP er~lu9~ɬA?^(((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((((( endstream endobj 122 0 obj 2653 endobj 3 0 obj << /Type /Pages /Parent 123 0 R /Count 8 /Kids [ 2 0 R 20 0 R 29 0 R 35 0 R 45 0 R 53 0 R 59 0 R 68 0 R ] >> endobj 75 0 obj << /Type /Pages /Parent 123 0 R /Count 7 /Kids [ 74 0 R 84 0 R 93 0 R 99 0 R 105 0 R 111 0 R 117 0 R ] >> endobj 123 0 obj << /Type /Pages /MediaBox [0 0 595 842] /Count 15 /Kids [ 3 0 R 75 0 R ] >> endobj 124 0 obj << /Type /Catalog /Pages 123 0 R /Version /1.4 >> endobj 65 0 obj << /A 125 0 R /Border [ 0 0 0 ] /Type /Annot /Subtype /Link /Rect [138.1562 667.0938 199.8125 681.0938] >> endobj 125 0 obj << /Type /Action /S /URI /URI 126 0 R >> endobj 126 0 obj (http://en.wikipedia.org/wiki/Aho%E2%80%93Corasick_string_matching_algorithm) endobj 64 0 obj << /A 127 0 R /Border [ 0 0 0 ] /Type /Annot /Subtype /Link /Rect [303.8438 681.0938 445.625 695.0938] >> endobj 127 0 obj << /Type /Action /S /URI /URI 128 0 R >> endobj 128 0 obj (http://multifast.sourceforge.net/) endobj 42 0 obj << /A 129 0 R /Border [ 0 0 0 ] /Type /Annot /Subtype /Link /Rect [236.2812 527.0938 289.5 547.0938] >> endobj 129 0 obj << /Type /Action /S /URI /URI 130 0 R >> endobj 130 0 obj (https://github.com/ntop/nDPI/blob/dev/example/ndpiReader.c) endobj 41 0 obj << /A 131 0 R /Border [ 0 0 0 ] /Type /Annot /Subtype /Link /Rect [235.875 721.0938 276.0312 735.0938] >> endobj 131 0 obj << /Type /Action /S /URI /URI 132 0 R >> endobj 132 0 obj (http://code.google.com/p/opendpi/) endobj 26 0 obj << /A 133 0 R /Border [ 0 0 0 ] /Type /Annot /Subtype /Link /Rect [271.0625 441.5938 454.0625 455.5938] >> endobj 133 0 obj << /Type /Action /S /URI /URI 134 0 R >> endobj 134 0 obj (http://www.ntop.org/products/ndpi/) endobj 81 0 obj << /Type /Font /Subtype /TrueType /BaseFont /IORSUK+CourierNewPS-BoldMT /FontDescriptor 135 0 R /Encoding /MacRomanEncoding /FirstChar 32 /LastChar 121 /Widths [ 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 600 600 600 600 600 600 0 0 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 0 0 0 0 0 0 0 0 0 0 0 0 600 600 600 0 600 600 0 0 0 0 600 600 0 600 600 600 0 0 600 600 0 0 600 0 600 ] >> endobj 135 0 obj << /Type /FontDescriptor /FontName /IORSUK+CourierNewPS-BoldMT /Flags 33 /FontBBox [-192 -710 702 1222] /ItalicAngle 0 /Ascent 833 /Descent -300 /CapHeight 592 /StemV 0 /XHeight 443 /AvgWidth 600 /MaxWidth 600 /FontFile2 136 0 R >> endobj 136 0 obj << /Length 137 0 R /Length1 22236 /Filter /FlateDecode >> stream x |7~̾>d2KfLH&L6 !0OHB$ ;AbE@qXֽkmuHPjU+`KS?Ъd;wL=w{ι9se/!OD"_p>?z7/xY v%Dco%ٴZB^ua6]q+ir xjddӴp%]MG\{AHt%˯'F:pKzKz7\K/^з'W.!$Ϛ-VHwI=(@$'ZD4+W"]-k!?Y{.H_\叴F]- ɱQO_I(tkbT%q@ X6@{@CYmV$~1C@$I]өm(,JCƣiP3cXǹ|>0gAeE?'os9ޜ79:pif`|*s"#9@9 ?1|ǘɏݏ~;g;;)0@K+f]bю㜮G<~GG{&g;;)0рhśzn¤݄܄AAL!%@Ȁv %Qr 6ۈ Hd(,tG΁8~D|w;hiIqH@#C/ W b#7b%5CD@AFx `EMGtD)1œ"R<iRksxf"xB (&RppfiLb`80"啕B2W 6Tv7/= @󞁊Jg`FK.`󅵜Wp\ laom`HG4` *Fۀ1` blÀadCU; ckB!;ǔ1C<& ;cOO-UIUWM.uzZb&*@(P( (%BRT*c?*Y&'Ÿ#L FcN)F}bC(yp |#[@8.PC6𜵈]sV#pbG  G/xG/xrBbG/u/xG/+Fl " ᕀWXZA[AoVoVN[A[9VoVo8:Я:Я@@ӯ:Я:N@] ԁAqq q0A3A ` `898 qށ8A?qNNG@G8G@G@N )Xj += 1l+xy-t9[,9[XX^|z8^^|z|zClb;^|z-,0>]%]>]tOtO>]‚9S8rNmNm9S8SNmNmS8S8qNmԆO:.Xo$x$9$x$# I# IHGHG<޸z덭_olX{q8G^B #<<< GD;DO'm@@O/H'F?}d x>r2j Xt@h@aw0:8~p`??;x޿>K+ًSO˲9ٜ6M}ޭޞPoG ^]cHƠi4F4DcKڮRvDLp f!F {0f]¤M%̚?J _@fKSt"LmpJJ͟tɐ054+O5':RQ\\F.G%GԤج!uf^jrlVJ~ޒ]~p ,X2D3,fOڸd37AΤuvFyfwSy&x_%OjVYifvLD6M;kTƋ"0˖=4:qXk':y3zM ^DX=N0+b([/Ϊ%ܴ+ [i9γuvꈼ8duɼ߮)u wb=ӿtGGvMn7Sm\L)tRb{^3DG=M)yѳSYp.y]垦yUɵguݮgZň%6wxemZk-&q^k/٥!;eaw{R4.S={qc)Cxz`QP Ȅlsyg/}"W$!N in6_|ojr.s6i_,ztYlbV"R.xebc,K[n_wPذe'+va+VQn-v}efyfCMii%2\K$?f\9 G3f^#Q џ2;|r)ncKߘͼO1A Pd2$2[pŗc_2@?F@iI~E&"$ig~#QշCE|%3SB{xiIZ2CV^}Eh]%^KFL%6kՇh^G;~@q̅Y ARDd mI{¹FZl(+NW9p̻?eFABBH/ K5;ɏA%r|Nt:~E.M F)qx*d=WӖOCcLGHn!wǰvmҹt)V8}~&(e³bT\'^-^##TDW+ܘLߝޓId6ŷd>A[E&Y@'k2Fr%|-{h{zs|q9B>#'zitz^FoG_K%1a0GX|XxEx[x_\ L|Q|[|[PV,*|\(-79|꙱L tgFd 2-g2/gg R9kv!o@N>RbYh!t#cC|y"F =BNXBT˄ k'_/ iQ/z0Ƴ^^'nC)~0)lbGq)KÊo-+Tm|2և6 ՠ/?\YU qx+F1[|9Z,4~L'ѻÂӭt$? 7!STXM-B V~?cd-U-2BZet?V>JYAA߮bWqp=rcgD/Jg@Jݨ=OPѫ6((«X gs AzwBN 2Hjފ~>$V)ý~2#GB+r?fO~IW@wS!y+Pa8*3Bz9Kހƒ9O6s~9t=}WNۧvz~1v%Fgf|ygLM| z7h8Y8J$MNQл(CtE*G0QH捹U]8R"ʊ ?s '+a},4vqy\= Be.4N#໛{ܞP={TOnEk~LwdKv ٣;z|ŋ.?on{ۜ֙iSNTS]UYJ'E#P0y +GAF4/_j vh) B91lkR-txCY3 \lIJ\)K |RWuI8L-.[k֭[s|YOQ <+Dftoַc3Ʊ泮d;= E/ [/Ƅȼn's[, SIOcyS.;:Ap]RVKdGsɜߎ`e<ƫجy6gd hɒ0:2= &cx*Ӱ&m*ձ| %M)#R8$G?;;gy.G (dKN %%l]1h4)+8$I $I'vgOqt\7Ru\CNM9+}V [Y hY nݪ;,5'2DRIIxp)Sw|:dQ*-\ׁ%ԂhzT;=`@CH*?Rکq㬚.أBM$%ERwD\ m=%0_~$8T9Erm!E3rR%)^*f C`e.ܦbv$0D)eaa!-@70u'd #,#@nDé%4@tG;𘈺3+m:#{Lp@ o#:D־f'Y!͓q{VjZU$dzKe; Ɏ2b?Y` -7W:3Lh,B1?@0NL *KY1`N\.%Qu[_Vף=FpH8Olγ`O>c қ:12Te]Do553_#-mۏ~ ,W2="TD"ѩEQpkՊ㔸4qH'gϑ-ՓdX=D%h-U r* 6 <+q%Hu3-Ea DN{"9Ҩ4eI&G+Rf8' GF=QU;cfb@O|=F-fn7;4TBg¡PSSmtXEpH˳;*'MQD?+j US=Uj|/EI %nҙ|SEa?\lhoڬ76 K '^ m*1GSɋ^/~Xwȟ\Ωͯ[㺰*UyW֮jjj$ j7VL\**b-~?#NO50$?0eJ^{lR^(&`d&zwƪ▪xl*>ZYj$9VdAb`:H:N|[l܊M&G>r(v+?lRկ9I'Wl9`Z&&^Svon+,r\RNtQ\Wf3[O vK˒vZw[vy/w9^SWZ BnOu)k Z19Ѐ7-JԹ%{FLb2K͞?iԹ|3]wHB6v:^[7ɓOW˞hp[࿮k./qy\+ޚ] \sus!86C^˽t≊`UTwC{z֕K.:o֫m{&5#ɸ鴞{JtzgB LJ~ݩ(LEk;OC}avam) px75Lrv&P;c[׽b>^̣}X)&׊WwUƦJi?U8ȑoϢ(ކIliUy:@ C/묓$˹T<1eϭGg۷"w9Q30V>"M4q蟽GGu^{ޝ}ŵsKvkV_trq 3\t_u)hzt[z)`Z4k UO3#{L .W(VgӼPV$Pƅ!^~T Sh,d="N_SND<"'袚GNǗ70N0X#BmM~6vlv*GTy[tIDLX=?k188;1^]p-_1uX T,Lޞ5z0vmKA6-"B~Z'; d悫d)Z7D Š"}$L F8ٰߐ+  b +p%C.eIqf$H`eIU% ¶=rCm|8Iyf q ;a%]]QߤOWraܔJ];Co1ya>~`o߄u6,LXVY{.A7PL_ ?\vT\(i% n)XKVP9!jM >.qaR DѾ"*]v;͆,CVtTd8όN&F6::hYNPlL 5NLW|m >9s6A5HQ)e7Y>;yEᒩ[_y7-t]prMӜ^O߻64{ZI.?Qi鐿0^RHuC!xJgW kQTr}뿅UAwK*Tݯ9kP@Z} 죲'lyk:"[ \P'Ԍk㜍"A"'{2tAI8g$9eÅGp wG &-mro 6h"3f)i$6=H[8:䍱(s *YIRg,c,pw}Rrg.u^+^߷p$9ݴٴ &I9 l\vM-20͘0ʷ凉mmr[mk_Wqmo_~zFa{0G~hⲍl mӦl.ж4U>bMԆ0C=͡C> ^O^l\zA- >d(t=5 0j&Er;ھp~LL~RP Ƥ/X ?>Y5<%gׄ-5`C)8'Jll+e<8K **5sf-wn3KY! .=~6_fH Zcxݔ)3'/`s@3Ʒ 3qR 1nHzM=tT1;c =ٵ 5(!d-l f@00,LI;XÁq4v!i8xc'# +stQ.1؜}Bi[Ħ.̂rϡ_b5ܞ v$YЯ&,`d9yL:ߓ$B) Dk퐵XvoZ=XXP ,(`AHFP;W m,˂leFA ,"tubهV0L\0](N0&ϣ5 ّZn=\ׯ[cye'`v%ʰ3[viͤ+wZta)T}CS7҇X~myQtnr.v'^<&[:%_W>ZL'*JmD9 %ni'ۖ]Kɝ2?" ֿ~L9٪|b=DOmyGr#= >[hфXYyy*ء/i5V},M ,^LOz҃si $u(g5Z\5Zq|>=ZuO^˦8i5mUv_f0?{=$z"k$"?)i fg+[w~ӪR[r~Q Ւ}z-m]&5ox^[~EdJۛuKJ8>-FI;:&seN/`̸X|]a{= >4})|2z#XGmG>p}Qn‡t>W:/*xT1OOk U=MYW:TAGbgA8U%ୁ+>$4}Q9^ ։Z{Bf-t} 0t 3v• þ -X]N؊knLq{l%sTimn}>/7U׌rۧ]0oǑXzOTCr|"4Vݘ sRGTD 8 Nψl+ Jh |u]fm>}ȧ|ܠ#00By QY`j8R9FzxUxl)0+lֶl90=FS7$\QDr<KEuA͉r{"Q.''5fLek,Oi~wzU)οR EL,[We sbL,}R]JII%g_bo+CWUb:"k*9mrn'p.|՝GcIoc:]7FqvQ[.0gD,f4l 3anjI0 % 4gfCn:riFCG -q=}|>~ADz+k{@ި:l!##yg ggP?nHA wqjl骶0ÃxiyڕM7"ܞ+HV)[vnm #3enX_i5בW4ckJFTQ #:VE[iStPDxh52 py`ecpҬ Y,ֽ£iaad˅<9;l1s'{GÄ/Gj7Ӗ<=@!ᰬͳ#iZ-vCad=':(٬T<1j'6 _ыdzu: d{?G\ 0~wA0ۑ܎ Eۃ9c.+'[0y( s\3GG5u0)CgR̥{Y"k|QE2̎* 74NmN%d_6Rɦ289<|y3)8ihz9|} 6|W/0O< 40OM< t Z4< ym􀾖%w鿻wPSý3btf˽=Ű/lrmu_k6gs:֗Z&>KzuzOIy~Nf*~L䛦ג f9 y76oUY!{6ؼ6jVWe5ƧrStG|yK^~Yw0Wkϐcfm\cD62 }M֛fJ}5Uզ'ɓO'毈#|a2M607?]@0qkqK%ɼ6[]fiuY].{Wl6a($`̟^0s6PGL8g_ճaq!=_j^YN$sۇr5Htš/E2VC1fj'fG4Q() Z>?s,y%bR4SsN>/G"4M/S!2IBJcN޻*(-1/7XL݉#'{|? =Ž灥?{}Wl|LxB,`jzy,f@,KL(l*Po%45?UV'[_^ر_X.178OuHAs;"+8v?0~w2Dχi/Lpg2ᜉ_xWh>~i-`bR>6oYׯY?e{׮僯= endstream endobj 137 0 obj 15168 endobj 49 0 obj << /Type /Font /Subtype /TrueType /BaseFont /JRSCOR+CourierNewPSMT /FontDescriptor 138 0 R /Encoding /MacRomanEncoding /FirstChar 32 /LastChar 211 /Widths [ 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 600 600 600 600 600 0 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 600 600 ] >> endobj 138 0 obj << /Type /FontDescriptor /FontName /JRSCOR+CourierNewPSMT /Flags 33 /FontBBox [-122 -680 622 1021] /ItalicAngle 0 /Ascent 833 /Descent -300 /CapHeight 571 /StemV 0 /XHeight 423 /AvgWidth 600 /MaxWidth 600 /FontFile2 139 0 R >> endobj 139 0 obj << /Length 140 0 R /Length1 43760 /Filter /FlateDecode >> stream xԼy?^s}\{^˲ , <P!ފ FYgͅŲK/\ROA9Å,.y+W^S,? Vԟ!DvRLOd"(GDRIfoSNY+?akF-_|ol<_~wOA-w44r)傪zDYf9UY.AN5Aa+Yxm'Xfl"ُُv~P ~`4|wDBRnFBRz=ipLءA/8]3 -rfH] t0000/S}+귢~+[ oJnU5hj=lR[)ktprf9^ SxܺVί+|o/ٵr休t~IIrwSQfiD9OSQDdN(CY:?8.Pձh㈑g0qXq$Va;»rk^A垔_'~|p -y v6mZK| 7a*"A>G$n~u+'d,^!:bE,n6 RMV"v*+S E؆AMEq\;? 䮖9/^_1ջkILSlC1$īqyw؄'0 LF/ R%J@>ljxu.5g9)1"a33-r܎x*{,gDÃ8ƎT4rc6Ǽ] FK{f;>%+/_ ~X-m:6a5;Ϥ͹mgrB~IKvDI9#/9~LϕcI{< w320gy CtHN ӆ!6Ԧ ɴD{@r\#a9 D$%!5 &v.|`АRo1*BKbMDCO EFT4-eT/$UBU*jQ]֫jZԜC$l'X"Kl/$9GpT͑IdO&K'И<zPd!Z`UW{̝sJ3W_)==9;z=~~fj??Dre?l:Fu9zjX뙌y7gw5g>:k:׮#AԏGB, GXKr?~;[C]v}ZGY2ϒR^|#!OH<_csؓ $΋G#]6s`ݢ`po_t,]xY\~._Lr>\B6-Q#y򜖛#JE͛0 ]uJ3|~;@lSp3w+~ǚsS ucy:1)`l >J 9}H_/9W7X0; p'(7o8RE?f=-6ClB0CX+<g*nUlUi$ rn⾦rRz;) Sb~57ޚZk1cAM:MjhQ:Ǥ иwW<:S(1;m.BDt>&B0<)8 B ]UiL"l.5Fr'vo%0b6,QAoFƂ*MD[7 z*y!Y{7ىj2c>;,CjPˀuGmq~ŝ-%"%:!l֒Q ܀U iI ,<4 ~r,\ITzTpS1Sjokmؐfҩdy"F¡`z.nZ&XfJxLWd|p ? #eBT,< u 4g}T)I` if]"!:w S9o@>.?507vfN3ҹX͐Z:;ռ#j^q5R܆u-[x<ݖ^~6C33Wg^|jvPN_jk_]mCG`S1;[5hّZnJw=c|D eNjwQ,R^KK=g4H˔ģ-Sa>Z[X5L)D ǂc|GA>>P(2U2PǩUZ"R7nd1Fmi/ê'<=8ѾÇaj27Ὼ #TFրXA-'dvp12XHX$8<7vpEED{Lݚδ-!.<2e!IKfԾGtӒ>hz]ӗ&i?{zwߞ* 讟vaqos0El|5B8+.WPIY;^˻@~TL &Xd:Yt{YyvXwwxTxlbԐN,{Tstr$:I1IC᜜DON:r: JsԪNm۳Q;"665ԝR7ά5izMmf)ukY ̒cnn);7NNʵMD'Y<-NmbnmKVee< toeG;'Fȑ"-P‘#GTtدTVìp X; G[DW'_0Euܜ4YNhWi: ksn0;A)]{O[5|}-S]NG~UjƌLx;rs3vnbt{ @n5=cfzLxK˚0O Xi. B6oMQ M9%y7E"9>_8JP13I-um夹JUȍ@NTIV_Nrv1崩Q{uG9"2ԠCdQʉ"* !%0Ie@EҌ6{2oKM "!CEA̠RU]L( rru FR/mKze6m5 cGT:Jaej-2ۖ- nkۗ/3֬`kJe)͋okfL?o v|]>/0r9*5_TsioKAŘ%%jmlF+RYjVF#M`f5X!:ۊPS]XTWGƊƎ(4&><5D|w31zn@yh$ Kܝ^Ζ5oO:hjL` iruY>(HNJಾ"]#Y'Qí#'VyY$lŵoGq*U"c(UB X~4 ^|֥q*u:]K~w 9gxUOoXv_gb]fUzj؜߼6`W?7DiZ|Q_υA؋ǹ]8uhzd}ƎL &P/ ߏ!QtK>%r GEk+ a,)e{Y@TפoʰL40@&1֙ # ٬fÄ'\ky$/3T??*L{H_M9:=s??S Iy@6[[mRiܠCnXcV:Bj4ktx5Z+ǩFP՜d][㰛8ڿ.z}S~т/h FuҕV_*:]-|S~Ùs/9a>*Τ<)Z֐9J !Fh,jŢQcz=ZVŬQfl6e0*HjRL%fMV !&W&O!zdTK) }o)njrU "p%v;}YΉdI&˘ȐR(! gZ PCX?Sm 7,`QTSQ20RJ5J@jhEɝae~f3LpFLl̿ߣtvu'Slp|2Wm3\J`쒝B0@+Uzo^AWQ{!jGE5UTTw_-d 8 !Ƥ ?MŽŞK|(cZkW\\ ?OOf!*,(E:;ZP+9A^#?׌pTOۡj8lD}4DK)'b5T[ 9-A`s lg? Gr -,^x!r>g ^Hdj}ԏ]&Xbhcmjci,N?StԬةKCO'jz5?МO/lPoJO%{s͛#(Fin>׵^ĠzOU4D|RWeU_l͜B+<+-wZfr)s6C2Q!H.@c̜6w fI'#$Q'# -Ӕ˸oi}WeW "I,P6{ͤ&p,jδ* 2WO˜xyp= EE{.W!Ɲ..yGP&d<:Vѫ*BæDDʘXD#ƐD=.Dq}F""~җdZf[\Vnb7 I2 ׄ#"r9#,JXVf]{Vr>+nWɁV49Xt%bĆCmLgqp(of`v0xEYd9r;']Y2:|Ehٙr7M~{gYtu۹_KB7^*Y>|cqEwo[î( dv OoG4=Co$II6w{q?0ӭF5j1SOK3c Ш.zR8JZdKV'pdquN"u.8gGH[Xj*?mAF˔,ª1jw4[BlF jy3p)ME]Z!ՄG"}~HOe$)&@))!Iք<>A3av\=2~Nj/;޶W˿Jn53 a$F]Wb Nx,g\X]93Do?ss2Z兤^on܏%r?s5*Q:t$)L'p>4ȥ0fH4uhbĄJ("rq,4IcߪFҸ*Y LE\W͔Th؍ZvNYuӝ~cF4L/sKG,yUYtW?r [ZX:뙫fފMOP}"N2`?r1mPK沲mPh ǃSP'x^P?0X qد|^vbDqWJF([O IJ:un^i9VMuS s"~!R vԤ & ~e$5VW5#!5"_XrO c/=BY瘹 )haMTd&$=mNO0=_<1:8$i|%eE8ZV*$-߃Kb!'DW6&hG@Ĝ=1Ŋ L * 6c8^ƫ (}u' (Nd{(ȍdӵm_Iqh6x]ye1j#!Ły\!d7׿ uN;etӌuDH}DWѺ? GTƨ;Y\2 ޅ Rl(GC7$-:6 ʵ Uꔥ2kYfr˞t2nB *.c4 -(tQʕURo?~7UM>Kt$jtq-*2EtJPd[y^#VEUcpl%)1LUS˰EiVAPsU"͒ w ɢ>6և*,IAe!"MFW :)-!3FZrhiEV!ch̐VUANR7x/W̨l;L.I0acCvk^}slKg6:&93+Vn۾xβwlz{]mq2;ΏC{׎ٌ`<&FRt8 %6bو ̄ޡ /RnNk2ZA)ne2|h Ռ{ft!cC&Eum C6d_>%<\m/3;ۮy)j͠CfXbƙ |A ngKgOO/2):7:owݔؖ+07{F_?7iEWm͂FC?VE* a&uy9σ~7ccrIiM&VUiA?Jb2ivT;g%]mU|?Ӫq|O`&f7c#Ɯp*Ӡl'` j9(tBJm4`EeՕqB`K" K#' E>!Rd%9rNDw:m}?嚦-+u7|]tS^~xC.Z@˩BJ&DGqF$#DeND2M>^Idl3Vh6ԑ  >ՌJآ۱SW){~Z6DILЕkR3QadV虤AӆZ~,9SC тIȇj LdH$*f(ӗqJh"FuDehc!m6 '#ZOůʾU0)2R#T3C]vɠ+{h?4J3`5}txJk݀h<h/vׄ]&@ͱ˒w[у_L7 KֽaPX]yDƶ~1R3z ަD yZCϒڑz4ktoiSwƶ)/NݬlSk+ŕդ5e`s9֞2N՚JW<)OeĘJ/>WɏN&=AuF γZԧ `—q篮9:3J}~~~L'CJ) g4m14jzIir%ʡcFQ;"L0cU{OV1I zJM(FRfUӱ51m$K3$]giQQ)*޲j\}}1"3AU"(@}~5r. Q/'òW4`j븛/OMf{w.kMx5LeM҅mwStaJ+< >۱z}iJjJn[_5>ћ[8;wJmm1 㐣h FFh9ͺ9֠$c^Қ?=qcu^'-ّmxMlGc>Ck4_EFƠ3+2~? br=@zD+3K,r4_lP 2.SZ[`uFA%bdLP…)C6ZAH4lT0mϰ^,| 2V0Y1i1D}}vَI߹WqE-VZl_+:6zݴ+%Ӹ`ٔk.ܱ +6|tg&`=*9j +kIW6}7D|^^dR)ct+gsOcu;]WNrDT:e[.9Eqwh?!:7SF/[rnvͫ4_i\<^AbaGIf+&OZ!r.(#^} *Q3 C㙒z_OGސB̍05hę8+yY@F.rtw ác يi ?@e}4㝹\> clQ+.,XmX5X:7i~5(4!?ܯG$OD4m!MMWdXCk+jj*+|9:w8=eSȇ<-zx➕K(Vƃ[*V YY?ݖZׯ8ۊ|,V. 2=cޡKx#> ﲛ" '<8=G T{Ig{=2`b󰝥+m,٧(Y22ƌ sۋFL!kBe3 ֿ| _\u*vM%kLS8TJ껷 ns#Ul\Qm7kοwGXŠXXI!??^LPttIBp٪>K|`EULVV2-cYhl#H{}l(GQ"tdIH@(/OGcQ_zLUuV֘klD~g2`Ee-Z피m;:͝vrCeB&'S׫gp+`o}DZ0t>G8DYLI$~1*;u TP }G +2hmK*=QfAm{ẖ%sDcI߯)5PerGuLV \v%oYM]:+GYӕ?.Q#퀹!| lP胆5hV*k?MѩmwoƾMG_/4\7@|"/g9>lzM>g 2]Nq2!4^9u1.lAK9i)j}^cWM=ݒ媲4RVUR8š&:lŅHFX1Wm:(/uIBp51(l $T*Sɤ:b%N!ޮVqa2xw( 9Oǎ&c54>q䐺WVPWwWUn4Ah%ӸPAb@9i?ĔL%aGNWI~< pu2e֙epT0<-8m@A"tzŏΓ\@#'u[5ɉ J>.z1c)X1)EL#:SO[o@g5[qXO,=ڿoG ^@g.[D|:``G,ΘC<`.q9ƭsq1F ո-fWd"P>V4.02wv)0W %:BbKDUȞ`eC3T1ѝ:DxF.!5ύ'+L?x;Jң>m$| qtC}78gzZ100i1> o" wp2@j˚\R`hS jB<6VlsR3Ii<EOw ED:]U 6I^%A秜H9VT[} N(&mqWQWVtz׫FkoH,HHHSrkk/xՂRnfsnodyKeu'9Ou5Ig`krf$v:VQzIc’AbsQAm1r@5Ŵ|Y)0vSv;/wg`dN:2S>pI+N3cpHevi;v'4جwAX*y3/v!E?9 v8WJHe8l`ŏ2+r,mR C%F,DE& }˿El%%,Jreˣ·:,s y<ڔ91TBs_&-LngP}=RBcfc=EN tu^we,8zB=8ezSc_L kHgdZ G b;?Od]+Y '=frwTwG_3_0X2sƅmg@Qp$ti/H ֧Xw[HW6/^Zi|ړ8TYY?irs_tnlvjFz5>zI]Umoxjo`@þ_]76kQ=2XE" u2lʕMG7%L_UqUՆѭ[*n~@M:Zw_fa H؊aԝPĒ$єAzUƘ0l(2bq`lb~5XJ?‡%4b]C'e֠GϞT|1;i|r*΄]Q~Du,gvXTGzvnENV hT%P)Ts8'YhC A q.a$ ]9~άPIOYj՘~ _}8zfJb9z@>I'}>PorgX% 'sY`-m7wVyռ*\=z{N̅s~%w~7Aܯ ]:1Of(m0 (hv !e8Q_F_YVBLBdM1MC`?w1r%>CbmKǵn-Lï aMH+eDW㤒5P!)4- #Bݔ$ ;vqZ~:C#=i.'ϊ3Ee'rE!% tֿˉ~殻^bʻ]E9m~h܏n˵wVKOfv/oy;}HHƑTk}دwo\tX#N8 #%[ǸFІ_Q&C) gŦD], gB͞ pprƤx$.uHMnNnKH* E[1tF Ztnbe.~ 6Eeֆ3DDqjT Zf%]'={JRO1'[Z N/ eXk)2Oo]$qxU'a N}4ɮU*ΌPAMr*t } յvݪתަgYz`a`X"Ja (f@1O?yQ#DSc8ȦT I0 &J % *biwouk{w]X%ɡ ^Q1P9`5٤UŬCړПtyH$ֳMc!ܓv!>HB嵾:V%J)@C`_pT+(E /Fa Dr(DYnfĨhYZsʚVB B*Uア)ɨb"7 8 6}ڭ#`շ_J_SX86gZ(⥠фUK.,@>uR} n q#9Hw;R%˸K@^{BaO<'IZ#s)8$ %9_HXm3sŘS i%,siOzFzW1*NWbjsKnkʻ;[Ob2Z&ca4(a1vwr,c FT F!Q>qDWH|6eZ',UY5LWi:G: ׅztidմZaDA .Z g5w. wSܣ}sZ AA o<x[nj&3g3e[\kT/9kHvDzn˸hDӎ9Cُd{iXzO ,>d1#x6#l߰3c)q+_7gp¯^ i) ǬRNul ]mXZh/o BLYS~A]]sBfPOS_oX/߻!A:Fg/.BǗP[I!o+i30z0:mVRc4a\َ ۾oaUۓɭ==ž7;>'>$Cf:S$()&j![@ΨМ%!x~ ^bJʠuva`rOdr_KRh-}J(=u ;?N&ZK+Y2|z}Mϐ.~cct΋7i>c: $rJn^Zl:wtA<`Q&M>4S<9k*)PPmL5(bV9X&k>OiʿٛcDTS,߮IOoMUUST2IԩΨ 4/mOݸ01YJ(~[-4dd)0)D*DgRȿ87!էN+?19 ,< 7.͏'nLhX:H{5u~gmM!ƒ{ oxi^ozɒQ gj&T9_r#/ցdtH;qU[U .C=fuȉ{Ԙ>E?íڡNW/PUQwUn ըݦGM;MMi'lya== Uu3]F KiW_q}pmuϹ=+'^<ʆA;\EH'ogzqYg_@qzl(#gi8Q{,I:=,Kd4n]: uQV**<!. ƝMԹC Ń3栍@]4 jcDbjڇyaG]j%7s sO%Ho!ǟmkoxrWW24fX{'n?#M2e/$/__o>~m kx|6 <c.4<#@T,|AB3y[V3\s> KxqwOPO F"tj62E0 iD FW84Cnf$rlsDLđ'5GQ% LsgrfjMfC?}_lo_lի#▽^Olyu ,o};gZFsR uܴ\bZ[Em=OZh DmQn1n%&$iI\ZqOC&ٚ;@FǺ͙hez62a*(% dL9٤rQ\54h]T'@#T #Z@GBOb0(|*n}nomʈo_Mn/oK &ޤ< 7gVA$5M[2G#/_r-wT MWV{uq~mO~dl7l~|0l[/abBHCCIo5x)px7OMz>K$=j/T{j3dd=Cu.n fbU!y1>SQJ7jr)!2e2ޯ54 R~@@^`|C "Eo絚'1MU^asT) 6txH f| D㥞*r!3g#H>s߽jeC _ld/:1{Ļsp W8ZJW^@o IIͲ&ϔ/Wߓ~g(&&uјtHQyM~\t@dI/a`<б;S17]3Sv#jWJUOU7DΤ{ D9}_6aPodsFVA: yQxw=k.ˣQc(Fю' I5>WV|~̚ B!p8Xl: r|;')[|LBs㳁M`hEFP:n.9iI!?yΜn_?%]>`D(¿ d]}j\L(Iѽ6zwHXi)ZG;2c; Kť)~73ofNdN,3 KK[׋S4XٕفAAf@î>Tѽ睘J$d%i-Z46N*46V}+os춤VO#KCkYt2"l&Y$yZi- (_RbMqִhLd1 #lX__Wۋ>/g)ڍڃdBOW BZH0,XyU6C&#9Ck^ZrDz<<RXwn>: O6ƸG\ܣccݚ=:F86Gz UdgEDWWD#щYfceX6>&'==92`}W|d5!P aOr|nW2 %1)L&PO 2)ҘOыvIZG>ogskFjEnFª*!lNfQA&l,Tey9|啎v dq; 䚟s\a$BASd]u|G Ȑß8&j31ܩ({J:Q{ў6T%$ۂXFX !Jb(&]˗S6E+赶q<'8D!D5eng|Ş[(0DQɬ8")晜rL!p K/@mrCZ.77׍d +8iY A߯;qp|wXBvs=A/ |6zyUu ۴?f5Z3yeaDx(򄉿>G6B44ZW MbeAIpV\tyIYIi=\Ɠ9Ic\l3T>`զ"O'soW5{+Sߖ)ީLsBz8 dO_X_׊(tf-& ooD,pMl@߳lVCR-$!GqZ`汮ѓ\|w˞4wBu3>g^{}|2x΢U Dj zV"|A*y:G̯MxE"ReE*U+tCE 푇{h ߪ|2tBg:d:f2b }! V q[k)pK=PěBQ;:]bpp 98#kD0( PU,;"66fZ YDn$l/4Vp`Y /cH-C!7tu)Ø҇c?"/w֭{>3JLjw.,qg?|#:n@G/U:lQUx֟ .B61]\As.ۛ7lz.:zZa`LB*cP%%}6%K˳Db ZDʫv[JV\1eUX-uKcY-!&7e%] ?8m;am^{sFwԳaBh7ӳU6g-N2Pb2Nҧl^Yx;&ʐ#{`k/,X;o}WNn)xi.C9DKڪ_ۇA=K!yշ= agZ{Fƌ0 vxz%wC; Ұ6p Oe7xTQGUFg XQrUVzlm;d;$pFbk}Cc !!7V@dV^)P!IfKʞްa]l)G8#QX g"Df4p92z`@YR9K8*៧GW(@>Vq,,A0~uKo>x>$ۭh=m?mIum7ok+~POg[jhƎ)be8FqF]PYEվ\;z ӴnZ6CӢͳFp_@~ӹbu@,)a>vWTwS֦/m(jֺT~X.6f pQ*뜳 k9ާD3L=Q 2R7RG(:j2☶Ĉ'2W:V)6|Jo.[sALmA:ڗ>hu9!n0ZvElBWQfb'T'@spg苶PBK-2Mz&Rq|_:(T+]^LAfi^mwN+Nj ߺׯr%)Sk_w++ڿzPCO]K򘪶QcrQ?>()M+c.F*{UK'^vf׏\/o7-t-7B X 5T5{O4ʎ1/"!ɡvq%$ĺ:`Ye.*`/nz8HQr95 =5"Dh~^;CSTJE g:zy ? !,{7g,hQt-!u"q\aWK%>'0Tq-ՒtT{dZ9Z!HғtZUUDrZlPnqD Qfx>h S=7`ǍigĈѹݺm\HrS u|&Q0 X(è<1G3mF:-O-\@Oz 0;\Yc9s#6(b6m۴m M+ũȭH|xKREO}ZPZDg)819$cI)j=!ib2gbOr3ɈiE_YQLqVr@;xx6hREK5/g_U*2iu1^ ϠdC< hJ6-dOsְKg3Ќ ǘ C~PzԻ!E2iz14#2KpҦd9Y1mɶ' %sBDN "<-=d6is&.A$Y}`1Xr|! 0|#00[#]L.5,\D$w} ? ; [[-WW" ڥ6x|knCz 9B~LJѽ擂h 4!x0!sCFg]lx6H]F!jq #r7 Ua,fWXDbQAsbCCP͂PU!2!#b^8ʳue.]QߣIx>#cI$/$ԅ?'?k_6Xx IR/ РFtPtrw_բR 7bX3Yl-EBfc4lV:ztTU 6<6vk΀RVa2N}j;/FPlT41F =>2.Jd.AC/0p+SGtM2] tg}n۽1/CUk<#(En"aΑ`o"Pm1ƦY#X%@IG ~CwGn͉lT)ַGNqҬTai'J y-Q1PaJ,%O頸M`.?Kn.=w|DHl!Bg]f ;ɨ+: 5J߰g0ߕ>&^}tHy<g BZl%N-xv+;3,^&ҿ2{.Lf+S$tH2ރ&@"eTlb`Rm["@q^h(rT Q2oUUyFHXoP6S| ]EH3A7Db8S']i*B%geCc42-01*eCcFQnNߣ/յAaS5 L+%/ 0S=44քc3fgE_^-S,i_^rUJ3 1Fr2d0:aw.1":16\s]bD=QzSfsQX\6D3<J$e&n?V|KJ.xHNA\n bI4K.CmuSN֡x視)-]Dh+% ?y2]uؿ {EG7S:mN`hOaF=7c uԄηzb3=20v{/^A^A]UF#s=$oodk8H% ^Gpi~NӐr i* c>p!~jP|Xnb:CVnTWEᐄuaʆMTIsXEH٠l?~$řfꇉ oJ؜ayz-QI]sn(*rlvFjxYQ06ݣmMA@%YTN1 Y<۬PG=?ɾZMc NmD-WYҚ,7 )E5&@ͧX<0% F 9GJյmg,O LXXz5_dWz9myI4q N[9?7A3?('1{OB41o_a@g_\ ].v_򡉻@1תSG}[E :SaaߤC%\KVp+?kٺ`V纸!tq!P]&Z{rs:Ϭ%L=YO endstream endobj 140 0 obj 30209 endobj 8 0 obj << /Type /Font /Subtype /TrueType /BaseFont /UZSERU+VAGRoundedLt-Normal /FontDescriptor 141 0 R /Encoding /MacRomanEncoding /FirstChar 32 /LastChar 212 /Widths [ 240 0 0 535 0 0 0 186 203 203 389 0 240 352 240 406 535 352 535 535 535 535 535 480 535 535 240 240 600 600 600 0 0 611 537 594 631 443 406 668 668 203 0 557 369 834 666 684 520 684 520 463 426 666 557 816 594 482 0 0 0 0 0 500 0 557 557 443 557 520 240 557 535 203 0 443 203 832 535 535 557 557 314 443 240 535 426 740 463 426 443 0 223 0 600 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 801 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 314 314 186 ] >> endobj 141 0 obj << /Type /FontDescriptor /FontName /UZSERU+VAGRoundedLt-Normal /Flags 32 /FontBBox [-55 -223 1049 925] /ItalicAngle 0 /Ascent 773 /Descent -228 /CapHeight 726 /StemV 0 /XHeight 548 /AvgWidth 464 /MaxWidth 1094 /FontFile2 142 0 R >> endobj 142 0 obj << /Length 143 0 R /Length1 15060 /Filter /FlateDecode >> stream x{y|U=uUw[HYȾ/@HJF I,@YP5q! :7u\㌌nȨ#Kw{ykTUw{ι~+l%,q,i(/ !p[=װŎk:{g\?Wewq9 3ۙ :UBn66.XHLLg)t) 23GQKJ9,fugN6!XBk6zˬ吣Ա CC|Hն|ģu˷Y?p쬩b igi-RE !>?!myâz{}<8~Ɖۖwμq#2+!~oY8u: C,0|uvb;4qC6Bм`m"d~ ϗ_VB|ސ96AFÞ@ )ia@`aϫ=IRxߍ-bGU"ـTG~2 ?*cϫq='Hr>1,+ScgV~p.Qyxn=N&YBC;~EƣG!` =!:>@D}@ LB JpDz"B$D(>5Ē8OH"I"$EO*H: $dYd6吹$G$BRD 'dQr|U?TQ#/GɗmkXL#[[q>N*PK5&ǥ5EjfhQ[}'ҧ)]6ݛJ~E c!k4-OEg5=wϿu c)tY (/@YjQ]E)@.UBpYU@FeRH\`3DAqݢ6_7ejDllC9r)1Es(E-bb0pREysf&̌}ћsPLd0BZ `mʉA@sԁ=<:3dcGEgL6<Ϙ k[TV6-_պ+㫤_hUܡ-ܮ[DQ҉FP[#p3)$Ys]Q~?s[XGw m̱Ҍ~}AznkiG+lQbNk6Z m|zj!SY .bn+ug=,I\RQG [!"h#ZCyf6XσU111; ԠEa]xt A`dHsi1z!N$={]ףIړz>C~枤W;0 C;H8Wba4<+t`6 '&(m]'=)^s& Wk/wVel:3F/CH2BKѳb"x-jPBLgԈ W ail2D2~> s9i6Z*YW悎QN""3G\Ge[wTV~QZQXO'BJM7UV >pc0Aߺyn~S*Y 9Τe]pq`ZVy|u?S_G=>Tέ:+v1`zbCa:T4-?+ vt4҉MY(#)͡dCRsa^ǝEnq@Ġ-482(ڗkO2-v/_" نB^Ha#m&[J8`£23xMݴvl^覭 $ST:5", ᣕ8mG0y$ Efpw'7l,pȜEm)0/#8cSfDXu3 $uI2!Dg"p6ťFJO0TT/@yX;(}st`tl 7_v}tlhNmG S.Ǚ4ϸOѣ˨ gHј,Nt!3*"J{FdlCq:3Y\cf4 BS%ֳp:QД~@Fqr%; 4#T%@O1Hk\c#3.ٔisF?=z[YM 3#ŔpfNfq{*N,TC{]`~HOM}6>J ~ó:|pjD)!i١R"p"`W#&܊Cn!i2fFU|l(D#B2Yz[8zV.d$2@h8 = cW~{N䄶[Mkߕ~3֒원t@u> 2]x= Pv>]SF>lśQmŁDY >WZ-257 Cd?z; V4v._OLV;x4d;RL\VDiZ&D V(U,2C*8cZ$Hڴa'Ah1zǃr-|&13QpδVqbQum Ͽr_̇q1~\ѐ7)C޲֩>>vmlsBma֌OѼ/|dR#\\?{nC:ۑђFDCUc>!ex-AODJ(v]`TiDb[ BYJ Ld8Ǎ9Z |nIv8}9!מQ1+S JhJf:;O˟oϽG\3O!:(Φ-I脀*3 5Hf^ W$/(e[~gan9+4V3y߼fU >.PT_ܮzqlpAaSU|aE@[lfԂYS,g?_;A$|,X0gY#=f%5Ә!@LfTtDS6ք6t}Okx{zKۑ_Iy 5|= uy%89=8 vFG{q*:;5kv]^?^~G[KsjzH@_KLǧΫ 1+Jǔ R||^ǚISnabXy*6.93P]dhCrBf *l7ZR#s*T?C|N;.Ãa޷wuqAylc>{j]:O~}az}̽}DJ͝A$a<@8Bl#&B'_X&jKxPU q↍4qS na#vӢnX\{jJl8[@2-F<3ex ҿ'xgJ8oҌ-y/qc[Y1?=\6t}Y13@ ZIf42m^b$lb7!OJ->A6f+m reuKqllmZЂ-X!"c!a@4Y|e٫Yg'7b}u-ʶ֒63[ĕ^If3W*{p2x-׎e B٦s*mmu*gªJ6uJ:ف>#D92e*fZ8'P xX8. `^:ѵg%sfAY1 -Xѱa @M@<-ciWW!>@8!z(I^e7!;l,fFPcD03\ g#gYQѮ*fXgU wOBP_i=N=I޳ /v={m/7_J>IS1,~#z5Λ?w;î~90ejD'J>GG4jښ ޳CWg3xO<\k/;/HwqUE+'H.P뚾\ˊk.ΕK䣗FFΰ%hʞ=/)ϐ1zdyoQ뭭ϭV唤[eO!Kj\ɇ1!P^EzYYdO(s̻zd^]d4f)Es:k',͞Mlml'-mIDz22RV Z5 A< 9ME~z+]SbNܸ&LP/m;~iיIWԫ(h)\ .M/{AO>,6KJJeDU)WH^S`{Od,W5N-rgE9Σk-Duv_~\\UvӺKnP[*e]zq<ҋKWaQ]S 3! (iP:fU1T+J6-$j%iTXŻk&DQѲc 7\K:W4]h/lJF5gX %l}k,8Wzz+Y/r@8ݩQX>[&I0m ]uDcguv^½{?s / ڕGpŪ0K Р4cxu/ycbN/ H]cM6l+.lo-.iԿx9Y,;bh^4#'Kˌ0fL;A8D0*?êoEGڋ*VR_ Ly+;j׎G/P"T>x'~HM Lr@<9@diC{[ rbgoKg0TdԻ /Rk/׋C uV%"aƭ؁AZV+RzZ[j=Q œAf~~,þnѽr_˲ZZ[ U̱+0k{NпYl|_mֵnذ1dbޥRIe[Rkl v9b˦HڍD!B+2Jy7ffL=\EhT7>^3Lzm`2gϭnwX{uw&YĽ>hjj $a<2Xm& xqeVu:IB'2 _bs--\d|ҐDm+r2'N,Y݇rFhUeYƂhW&'8L19S%;˹ȅ' meҟ~#ܡeXF(X.`-g`M/ނCzW _74Nllk{yIc 0T&5@v>,gvhQ}XuN2 FA8Z$W3s 0&|2F7$\ȧZrYo2cYk ޭbI觴~K!(otߛ" uی [e\tXG@b!we\L0% D=XCUBUS 2cꚼvӺ&p* 'j1x蹧ޡ?,Vjq6~I]@)>O5}k>GɬRjZ[/к;B(4=k#( b01j_)ʩqDFV4_%ذ)#Viuq^CB$R1&k5RGNko~A#?=1= qGpǞ9.'?c#-pYgz q C+NO=l+1(mo='kZ v7̬Fʫըi3$?&v,(`*Jr)bND$d1_i,ACڧOhi?_7twAq#;?8{ %ǫtNWg*r$'2 )(Մ[A2*7 r|6T .9HXό85-{U3&W:&O Ssw5v˒N5v@W pmM/%ZHGHeMJQBKNQuo4Z6ohc~?tAUQ2kG91HUKhtӾ(m?CѩX Ji*UYxO* Y?rښ5Um: |WUPOm%sK.o%V\S*NŀBxzNWg1yc&C8CJ:#Y$c*UMߏ#H2Ћf,^]KH钃7͗[rcm+ޕn/Zepo-*ߖڝVVնdKcE@d-8k F5kfH~jZPg8 ~劋Rk06+y\WtlT!ɥsCpJSAܖ #HM~`^yKM鬙T4ٚ-D*N C3ukvlV4}U+Jz90gݯZ91^2)*k~ceP9-*]6ӜPbk,p果E7Y:* Tt(᧱dnWd`Q^Yƺ՜q2k9Ғܕ8'ú'IwyCf s& 0a4܍-8M=]#jy^@b氘`FoDVU>* qg C'}k ͹5_\̤Ћ9s zʛ}5'kKsYv*%k}#=@:T#I?' Z(.{+e#A9^ؒ[+% jRҧo*C+ BWz-?yV?)O AO'rTϓ5d!I-#4&LAǧ+| 1^KNYܸzq\k{X^>omOy_ endstream endobj 143 0 obj 11270 endobj 24 0 obj << /Type /Font /Subtype /TrueType /BaseFont /UTDOFI+VAGRoundedLt-Normal /FontDescriptor 144 0 R /ToUnicode 145 0 R /FirstChar 33 /LastChar 33 /Widths [ 0 ] >> endobj 145 0 obj << /Length 146 0 R /Filter /FlateDecode >> stream x]j0D= gc():EAk࿯zAz3gHJ` X gux%mU&*a[@mWF$\h '} kwD:rċAO>S/[F8<*Dc!'it4&U$j~O=?c endstream endobj 146 0 obj 207 endobj 144 0 obj << /Type /FontDescriptor /FontName /UTDOFI+VAGRoundedLt-Normal /Flags 4 /FontBBox [-55 -223 1049 925] /ItalicAngle 0 /Ascent 773 /Descent -228 /CapHeight 726 /StemV 0 /XHeight 548 /AvgWidth 464 /MaxWidth 1094 /FontFile2 147 0 R >> endobj 147 0 obj << /Length 148 0 R /Length1 1324 /Filter /FlateDecode >> stream xuTQhUwf$ٍ1 jg;]j3b v&SZvNn$MmMA%-1"(~]|CG?KSDذ4ޙ] U{;;swx \23I3kzETgN{m.|J m.}FfZU(*W[nsHWg:y2qs;ï3W&$cd.Tj ݥ饅ry';{[V/ʴChv>@W[NdBA1)Ҟp?ӽhWY)y#]uq (8ѪVwnЋYU7#5VTzYQږIM~yNba|؋(c؆~{pرڒaNh-VQuXԄ eCL)GC^?&k"bq&HuiU:.~%)MaEHX"M7HW~,zXI9@@inß`g{7"ᐪLIwuÞ=iA'!5Z`,,pt Yf~\ b'[bPczsY{ S6@J$.w8g노[*7G!>Mg$KY~bF-sʦz;W/ږչhMs1A .S9q@7?'wDO 6m=eʸen@ O6Ռ1QX =A/,Lgrb|2oYf Zړ ~֡;&D4W Ӡ2aAY("2`+ ,z0%b 0|;Ck՝|[BoǓa7{'N}DܙRV:^]s endstream endobj 148 0 obj 963 endobj 39 0 obj << /Type /Font /Subtype /TrueType /BaseFont /DGICUU+TimesNewRomanPSMT /FontDescriptor 149 0 R /Encoding /MacRomanEncoding /FirstChar 165 /LastChar 165 /Widths [ 350 ] >> endobj 149 0 obj << /Type /FontDescriptor /FontName /DGICUU+TimesNewRomanPSMT /Flags 32 /FontBBox [-568 -307 2000 1006] /ItalicAngle 0 /Ascent 891 /Descent -216 /CapHeight 662 /StemV 94 /Leading 42 /XHeight 447 /StemH 36 /AvgWidth 401 /MaxWidth 2000 /FontFile2 150 0 R >> endobj 150 0 obj << /Length 151 0 R /Length1 8068 /Filter /FlateDecode >> stream xY |TŹfM&3@v7' lL d`RK&`b@A(BԂTlnJj-XUZ-u 9?gww'oΜk7R?L b-d& kJN"+ZVK9ԮkoX1vhZK4Hsjf.v %BBMqk84K]zFo UZN[ZYTZf.K%meG3Z26gG+4ßQ:rXiPz]*@=Va r&piς`,H ͂rIs?'5QfL'r3au` LYԐ5u)}BRvR~;Yhk4**@ =f\|@-{@*<SRXr@qjNy@9謓NRg5j%&bEe&Hz,>tXĬ)(Sp \4~1Hz}Kf j2=^H|ʙr}A#uvԔgM\`i ^F`["v*Jb˞Q",c(GvҐ!x osT:x?䀝2}&&.gδ9L3PTMgTϭlr6Eb'1?m7[nn8];d 4HK}>i} >PL+1@=>cqhgIU:/r!ϸ|/9+ 8Y͠ρ=H>Qw!ʷvR~?aH?]QހQ@^&{߃v޵ ;o?[I\6KOfFׂl{e XQ'FpθfNrisI3%I3Y鼝Mjk7{BN`Y}w?|G+Gj+ '62"<8keand`s2ml6bSlFA 㬿HYS6#Ŭ;52IY7K3gݦ,7i~0Е$a3hiFU+ x}(Àn)Ţ8* Geݥ&%@c+t$ IR_eYqY8x3:i/VMQc,DY̖2ք6-vY(?e'P^egS$x Vi|.7k#@n׈'REJerJyIy]JuAIݧ>cɵ,g9jrj⸺հyc >5Wb9ZA Ѣ"b^'֊;op7YX%w,_8r|A; Oyƀ=eeE_~G|gTcg}%r)g@:6~/)WU|#^QBvƋlRaX}®}'YgC6j&cˋ^>|0B崘ki-+E\xvQӂM^feCbIcۑg /ͧRl[rph-Ǿ?''ۨe`̆ox_ 1߱?]?B1^*Tfe9}t2eDo- w10| ;ۃ^3_M'?ʭ >Os^LλX;jމ*^7۩xX F_)>~طӛ؏<,>F >AwV;W_^bkq.zi\eԈ<ҩXI:`Ul<rw4@TOZX篘-ߔɓ&^9a%W{ƌ.5S]μs 2hL{4բ*WioPQ]M^,y-Ar%ŠbOZ/Y2Gb++ ~G@OlˬQwi tu Mh˺2ҫb/ugt̬`y'Sԇi>TCSt#; Ɩ{pλDyJ_ /Zأ| ,qس[Н6]R?G9Ͼ0'#U̾0 <Ȣ叜0J{[tJ"AΖKۧoL!! #6z¢U[4^7y]1 endstream endobj 151 0 obj 5510 endobj 88 0 obj << /Type /Font /Subtype /TrueType /BaseFont /YEFGAT+Times-Roman /FontDescriptor 152 0 R /Encoding /MacRomanEncoding /FirstChar 46 /LastChar 165 /Widths [ 250 0 0 500 500 500 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 350 ] >> endobj 152 0 obj << /Type /FontDescriptor /FontName /YEFGAT+Times-Roman /Flags 32 /FontBBox [-203 -428 1700 1272] /ItalicAngle 0 /Ascent 750 /Descent -250 /CapHeight 676 /StemV 102 /XHeight 461 /StemH 44 /MaxWidth 1721 /FontFile2 153 0 R >> endobj 153 0 obj << /Length 154 0 R /Length1 6516 /Filter /FlateDecode >> stream x9iteKҕtgtꦓ;NBMR ECL!l2 lAF7T*2A)3F#c\FU9w<~N}w~]_U/YtG` .2 mkepYs ~m/ h2:;Zۣ8\!XI(fw,YMG Zom'#ijK5v\Kcų_ tه>OZ:/JOl}̈́= j8eJc|8J{k7}0*B6 '0X$[?z9a7=3a,{Q S/֓_kˀrHg7,BfId#Te8)*HQ/n'=T&;up3l!7(J|G:#pyMhNgU|3m;ZJ$&A8fΎeIҌXE< o1j<,`ԲYG^(cM!As)z35kb%n*4rWdOp"8V!ԢSɇ}xd11wl/gƒ"FEg輑C+_Am4٨0 N#arwNi0fQX %50FF$FIjGIfyl1;>>Ϸ ~͗Mp{xixUP!PF(k:&PSVp.PsݧS;@^Cp|.P]<<)nDVЋ3i}nln\wݸűcxߣ6}13v&j7SkeژNaR{cB,UlJMf'rn 78wy7?IcTjjviji_Ҟ WӵW,g3̍~Kϼ1i%V^EzvEg2%(Cm尀H#ss#lV1+3#ݒfNMINJL0Cl^K$^ʹ˵_V"^CV"}_F*Z=I$^')E%hzSVm[x$uM 4hgZe X}r>_[Sl*e׺0N'iL<6.7Nmym6Sqm92kxtel4Bg=ebho I0'ZomV&jʩ+>1~;s SfrZ;d)k)+3-2''TߣQDl9n;shj Z$%&Hs| 6J@aMao~{D;%t5/ضO 7ekjNV6G).Y?.gC!9F"}:L/TjEȴMAhΆ[W{!fS=0yJ9tyi6!N"hT֑uʺY}uNZp.G(i-]7dɟ~u!=EM!>?i@P%HlP-S[5tY)%TbG[#T]~?IQÞ\e|., +ΠkHO9n){"'HÄ("JpM#%`+n#^2vyMpUif)y[fxR~LT+z &+ Wex5|LXt]üMg卆i2Їoѳ>Ja9@vZ5rag*G4?DgY18+v 1<7e^ik2;/x& y&/y&.4fad!ibN} ]l;=R$$%$q]bb16ešLi5Iyq|r.tt( gj33\.jf QyʄJed|7Z(v[.epF]V)}!gPoД!gt=Fñ)3VL ]юBuW85;{7Ow9%; ocŖ+*l+?{]E~CJ"#_KnzyPLHe)Jm[ۭ[]{>7ٱ69X'0 T&\̗F#z]YJO],~\}~0Y98}u%i'4WS9rz5%8m*\Yo>f.;~}(!)ʉl#"{6U<-go.*NȳM1=s+l9ZJＩپgTڇ<7ujQe~ESg&XJz+M}X/X gX'X.7% 1Ą0K.;1\mHVs72&>N-fz6ERR"8^ɋmdn1ewyrmʪ8}5/ػ FnH2]R2}OF$%c|tK:8 X"ew34.)f2r̥7d9IV>h Wc9j򐫫]sR+79x5 RM4CnF6D[-i l46}fsv  `Z.cG.FE#qh)UT#xwdsܝcXdg'swM\<>Ws<_=Y.3)Yqz~OFZAӍm'YJmo cֱoyxt!\:.uMv/_ ?u/X WHU^舎땿 LDRͰQ#$uk]= z{Z l;E endstream endobj 154 0 obj 4397 endobj 80 0 obj << /Type /Font /Subtype /TrueType /BaseFont /BWPULQ+HelveticaNeue /FontDescriptor 155 0 R /ToUnicode 156 0 R /FirstChar 33 /LastChar 33 /Widths [ 278 ] >> endobj 156 0 obj << /Length 157 0 R /Filter /FlateDecode >> stream x]n {bKq_Nr`X[HָsRl|0O= 03qc0Ht4$d}͸4EZw8=8C^#y2l)}႔A cT{.?\ǞJBt?\&-(RFnF ӑtFQJٖu*Zx6Ҧ}U)`o|&pA endstream endobj 157 0 obj 222 endobj 155 0 obj << /Type /FontDescriptor /FontName /BWPULQ+HelveticaNeue /Flags 4 /FontBBox [-951 -481 1987 1077] /ItalicAngle 0 /Ascent 952 /Descent -213 /CapHeight 714 /StemV 95 /Leading 28 /XHeight 517 /StemH 80 /AvgWidth 447 /MaxWidth 2225 /FontFile2 158 0 R >> endobj 158 0 obj << /Length 159 0 R /Length1 1788 /Filter /FlateDecode >> stream xUO`޶l!R6C̦!S7""fփfF&xM0=x,RHAc41#Gx6(bhK2sנzHB9?MVWQ\l/{9>`̵MOF~Եidf!˕Y31Uzr|ZLˆ 9=u/!S34⬛ Bg"IuN&Ba9.Z0}x4ڷ~0V:3upjD{#N5WCoNN 65kTgo:Eq:HHiD.mvHML>,fl*&맛PgNP'm y6xdgh"Њ÷UBQF` 8ThbBĎޫZLWL5^G"`zRhH+aVZ}3#>(AmJ!)W,pNԬjF]VU%k-4k)#]!`v!^vBM%V%ӔMTIyؑY:P:Sc*p',IRJ|ȭ:];DPڰ-J#>MF9)ݳ53ނpu 71o}{w0o[ H71,sgg8-[俴`+K}PV`zaTCt7G=V >%1kj"?c%(YZx0`BRs#@wH(SP:ԨUln^=N \/蘫#΄R*:N˃=R*ף endstream endobj 159 0 obj 859 endobj 50 0 obj << /Type /Font /Subtype /TrueType /BaseFont /CZYJAX+HelveticaNeue-Bold /FontDescriptor 160 0 R /Encoding /MacRomanEncoding /FirstChar 32 /LastChar 32 /Widths [ 278 ] >> endobj 160 0 obj << /Type /FontDescriptor /FontName /CZYJAX+HelveticaNeue-Bold /Flags 32 /FontBBox [-1018 -481 1437 1141] /ItalicAngle 0 /Ascent 975 /Descent -217 /CapHeight 714 /StemV 157 /Leading 29 /XHeight 517 /StemH 132 /AvgWidth 478 /MaxWidth 1500 /FontFile2 161 0 R >> endobj 161 0 obj << /Length 162 0 R /Length1 1956 /Filter /FlateDecode >> stream xUMoU=ov|؞$M38i+BHDmS!]P`9:8,^!YM$V͆_0H%Yw.@HH" 6wTPE3w߽;]]uЇ:TJbftr+%eߏJ[-;E} 8C;^Ԯ~;R{=r~R{uG_^u¢z'Q5 ę$+xC>xu!ʟbD+S내Fhy6W:?oxH41d-)v$c8fpDGd9A hP:!n2g>]J1<@dmN& 5B.0Y51n>Y b^BY0H>LB5wÝHnr+IkVbhR sg:~%rQ2sMD ַBܰclʫ jBdt}f)( Ԍ>o[i[os }V/Єg4bZx2ܜ mLa 6o#z&3s(XoYn=rsy;e[|ʰmfEd,s9Gv!1)' wH5x/6O*sԉ,K)Hi<> endobj 166 0 obj << /Length 167 0 R /Length1 8932 /Filter /FlateDecode >> stream xZ xTE>U;O4$"7>lvB:@$ oIbБQܙotYdtqY_:>]YYGF޿ݐLƏtvΩsԩSvw疮J I԰}lvXvkl3}F3L>{;b9`I_ fW'nn_oݼ֔OG;qcvs|zmyS;:Ͷ8}KٟyLjiJBN3hQ٘/,#V\`L @ S0Xt>3\T,GYy< ,U2bL4h~D?z0mEO؃n)Ib{Q>lQ#liG\-HpV~eU Jt,SGo +~DR}Ģ>r$U}NTA?:ՇH##ǎ I=\)QoϬ,~^&D,i6A 4[NHL,rг|MBd Dd1//M<(|oT6s*6c*|^?fNMӭ+“++tRW/@d> @\]Jd"8eE= {2ΐ"bsR%g$aO';;.rVVgYfoL|x{҆duWVNcdM٫ # D~Z:~B? Ypv.01i<[J@cx%^ ^![P,TU ̉3Ý_NawDb~~D3/w|ChM?n@@p`xفR?آJRCՃ Sl fb_o +.fh$huۡ:@"h TƦMfSP+(Me*|VNFrcP&DI(EʅqMnչWf]kk237qFTKs'O(bfJ$VT!lLkJj51)*Y$wvBRvq46mdK7HCRT8؄\,KNV*uMvMrMtɮ"ÕuelWKra6ӲꩾZfl>"ɍ,^KiXc^0j,ȪYaB=8UkWSzx57b&og>Ou@='YrkshZ}uFGe}=TOV^d*=Osqe0q؁lFnOgl3q vvlJG'L/GK; :*%v!KA.iShu𩪖)HiQݲgCmn p{ Ӏ 1` 5npWr.3` pPe@51΀@0 Zr#aV2WaU)Q<L%x1J\Od}[/?/tE:х\K'j4D(fF:M'iG]O4HOjOi J? m_S۬t<#G_ʃQp ٻщv.[aX9gMx=|z)@$J0wd0D+ŌqEa|0E 98y7f[`7?!`(ׅXz.c-V{=\ɖǥ/k+ϥY‹_Fqr'z/X&ӻln\2]~7 zhZFpF5Foxf9:>Uۅ1: "O N;i U~D4>jSX:\屺!Ck+L&fAs7XkM-xBN^(ĭNbG rs1 5}rE+aZ)nK֨\c9XraJ#jg+ƈ'AрbL?7"Crћ9tNNd/-FiI,p &X>f z;9zm($%xH>xft"tkLSKђ '6ݬl8twk5ojR3#ڤoX[eܵz!O!E_?J#HWj!Kw;H2U-;B6Y4Cv"H Z( <ŊǗM}qe-fbwX;Cv" b*iȡ-TSCNABOˠiU<9 }dөB1^Dܬ =PM:P\3YfH,XĤВJ'LW0Tv?B6<ى{ݹ|9c| AJ# ZE|Do260fC#> ?Ō8r8^"8BlSx̋}Cxz\;Exږr810[bra{@MkЂKF[50U_HceBI~k/s9<ϡL%K9{~@nВ1}k.q$j*>\8UW1)+)EZBwL, ESI&Qʱk̥<*ˆC\qEwU1 l\1I`:xdf)bn|i %ubSam-iNT/09GW1mDU&k;=.3'07ycF펝iU>B)$DX'B;zMeiŀh,+ceM^'>IBH#-!_9u%qjn#^m΍T=䃅 *t㤚aE׊-cW MWgTWVABR4!l ɈP=l.@"·}{v)]᭗mqOGDx;|&"/;/0~d*F LOP&> endobj xref 0 172 0000000000 65535 f 0000180452 00000 n 0000000881 00000 n 0000097103 00000 n 0000000022 00000 n 0000000862 00000 n 0000000999 00000 n 0000011977 00000 n 0000145979 00000 n 0000009205 00000 n 0000001158 00000 n 0000003501 00000 n 0000003522 00000 n 0000005285 00000 n 0000005306 00000 n 0000005693 00000 n 0000005713 00000 n 0000009184 00000 n 0000009241 00000 n 0000011956 00000 n 0000013000 00000 n 0000012013 00000 n 0000012980 00000 n 0000013136 00000 n 0000158320 00000 n 0000013246 00000 n 0000098507 00000 n 0000013273 00000 n 0000015036 00000 n 0000016257 00000 n 0000015057 00000 n 0000016236 00000 n 0000016378 00000 n 0000016499 00000 n 0000018262 00000 n 0000021991 00000 n 0000018283 00000 n 0000021970 00000 n 0000022127 00000 n 0000160125 00000 n 0000022260 00000 n 0000098274 00000 n 0000098018 00000 n 0000022294 00000 n 0000025110 00000 n 0000028137 00000 n 0000025131 00000 n 0000028116 00000 n 0000028258 00000 n 0000114686 00000 n 0000173119 00000 n 0000028403 00000 n 0000033862 00000 n 0000038033 00000 n 0000033883 00000 n 0000038012 00000 n 0000038154 00000 n 0000038287 00000 n 0000042929 00000 n 0000045454 00000 n 0000042950 00000 n 0000045433 00000 n 0000045590 00000 n 0000045723 00000 n 0000097785 00000 n 0000097509 00000 n 0000045757 00000 n 0000047520 00000 n 0000050631 00000 n 0000047541 00000 n 0000050610 00000 n 0000050752 00000 n 0000050897 00000 n 0000055596 00000 n 0000059531 00000 n 0000097227 00000 n 0000055617 00000 n 0000059510 00000 n 0000059653 00000 n 0000000000 00000 n 0000171388 00000 n 0000098742 00000 n 0000059810 00000 n 0000064266 00000 n 0000067437 00000 n 0000064287 00000 n 0000067416 00000 n 0000067559 00000 n 0000166207 00000 n 0000000000 00000 n 0000174659 00000 n 0000067717 00000 n 0000072245 00000 n 0000074553 00000 n 0000072266 00000 n 0000074532 00000 n 0000074675 00000 n 0000074833 00000 n 0000076596 00000 n 0000077425 00000 n 0000076617 00000 n 0000077404 00000 n 0000077550 00000 n 0000077672 00000 n 0000079437 00000 n 0000081882 00000 n 0000079459 00000 n 0000081860 00000 n 0000082008 00000 n 0000082142 00000 n 0000086117 00000 n 0000088893 00000 n 0000086139 00000 n 0000088871 00000 n 0000089019 00000 n 0000089153 00000 n 0000091464 00000 n 0000094000 00000 n 0000091486 00000 n 0000093978 00000 n 0000094126 00000 n 0000094260 00000 n 0000097081 00000 n 0000097349 00000 n 0000097442 00000 n 0000097632 00000 n 0000097690 00000 n 0000097907 00000 n 0000097965 00000 n 0000098138 00000 n 0000098196 00000 n 0000098396 00000 n 0000098454 00000 n 0000098630 00000 n 0000098688 00000 n 0000099153 00000 n 0000099402 00000 n 0000114663 00000 n 0000115410 00000 n 0000115654 00000 n 0000145956 00000 n 0000146685 00000 n 0000146934 00000 n 0000158297 00000 n 0000158801 00000 n 0000158495 00000 n 0000158780 00000 n 0000159049 00000 n 0000160104 00000 n 0000160311 00000 n 0000160583 00000 n 0000166185 00000 n 0000166636 00000 n 0000166877 00000 n 0000171366 00000 n 0000171880 00000 n 0000171559 00000 n 0000171859 00000 n 0000172147 00000 n 0000173098 00000 n 0000173304 00000 n 0000173580 00000 n 0000174638 00000 n 0000175150 00000 n 0000174827 00000 n 0000175129 00000 n 0000175407 00000 n 0000180264 00000 n 0000180286 00000 n 0000180332 00000 n 0000180384 00000 n 0000180409 00000 n trailer << /Size 172 /Root 124 0 R /Info 1 0 R /ID [ ] >> startxref 180562 %%EOF nDPI-2.2/example/000077500000000000000000000000001321103654100135765ustar00rootroot00000000000000nDPI-2.2/example/Makefile.am000066400000000000000000000005311321103654100156310ustar00rootroot00000000000000bin_PROGRAMS = ndpiReader AM_CPPFLAGS = -I$(top_srcdir)/src/include @PCAP_INC@ AM_CFLAGS = @PTHREAD_CFLAGS@ # --coverage LDADD = $(top_builddir)/src/lib/libndpi.la @JSON_C_LIB@ @PTHREAD_LIBS@ @PCAP_LIB@ @DL_LIB@ -lm AM_LDFLAGS = -static @DL_LIB@ ndpiReader_SOURCES = ndpiReader.c ndpi_util.c ndpi_util.h uthash.h ndpiReader.o: ndpiReader.c nDPI-2.2/example/Win32/000077500000000000000000000000001321103654100145005ustar00rootroot00000000000000nDPI-2.2/example/Win32/pcapExample.sln000066400000000000000000000016111321103654100174540ustar00rootroot00000000000000 Microsoft Visual Studio Solution File, Format Version 11.00 # Visual C++ Express 2010 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "pcapExample", "pcapExample\pcapExample.vcxproj", "{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}" EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Win32 = Debug|Win32 Release|Win32 = Release|Win32 EndGlobalSection GlobalSection(ProjectConfigurationPlatforms) = postSolution {F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}.Debug|Win32.ActiveCfg = Debug|Win32 {F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}.Debug|Win32.Build.0 = Debug|Win32 {F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}.Release|Win32.ActiveCfg = Release|Win32 {F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}.Release|Win32.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE EndGlobalSection EndGlobal nDPI-2.2/example/Win32/pcapExample.suo000066400000000000000000011270001321103654100174700ustar00rootroot00000000000000ࡱ>  Q34Root Entry!@ (:%ProjInfoExTaskListUserTasks$TipPersistenceDev10+*$ f !#h&'()*I./124578:;=@ACDEFGJKLMNOPQRSTUVWXYZ[\]^_`abcdegqsuwxz{}~BI8ܐ'C  ^VsDebugPresentationPackage, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3auMicrosoft.VisualStudio.Debugger.DebuggerToolWindows.DataTips.PinnableTips.Extensibility.Persistence+ListenerDataStore RC:\ntop\dependencies\nDPI\exDebuggerWatches DebuggerBreakpoints(^DebuggerExceptions& DebuggerFindSource& *ample\Win32\le\C:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\vc7\atlmfcC:\Program Files\Microsoft Visual Studio 10.0\Common7\IDE\vc7\crtDebuggerFindSymbol&)DebuggerMemoryWindows,TDebuggerBreakpointsWindow4 ExternalFilesProjectContents:B~MultiStartupProj=;4{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}.dwStartupOpt=;StartupProject=&{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6};?{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}.Release|DocumentWindowPositions0" HDocumentWindowUserData.SolutionConfiguration, ObjMgrContentsV8"56789:;<=I>JPKLMNORTSU 7_D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\example\pcapReader.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\nprobe\nprobe-win-32\getopt1.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\ndpi_main.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}||C:\ntop\nprobe\nProbe\nprobe_win32.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}||c:\Program Files\Microsoft SDKs\Windows\v7.0A\Include\WinSock2.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\dns.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\third_party\src\ahocorasick.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\http.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\ssl.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}||c:\program files\microsoft visual studio 10.0\vc\include\string.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\include\ndpi_protocols.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\include\linux_compat.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\netflow.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\postgres.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}i@D:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\example\pcapReader.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B-ST:0:0:{3ae79031-e1bc-11d0-8f78-00a0c9110057}B-ST:0:0:{cf2ddc32-8cad-11d2-9302-005345000000}BD:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\nProbe\plugins\httpPlugin.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AWin32.fBatchBld=;={F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}.Debug|Win32.fBatchBld=;4{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3S$ A+HڪWLl #O¤EL%ү##G}'bm4S8fLd9Ll #O¤EL%ү##G}'bm4Q C:\ntop\dependencies\nDPI\exaClassViewContents$ ProjExplorerState$UnloadedProjects"HiddenSlnFolders"mple\Win32\pcapExample\pcapExample.vcxprojjC:\ntop\depe !C|dtCple\pcapExample.vcxprof{F6A2C0AE-2110-438A-87E4-7fC:\ntop\Source\Copia di ntop\utils\getopt\getopt.hC:\ntop\dependencies\nDPI\example\pcapEBackgroundLoadData&"TProjectTrustInformation0VC Project$rOutliningStateDir$%xample\pcapExample\pcapExample.cppjC:\ntop\dependencies\nDPI\src\include\linux_compat.hdC:$Bookmarks V001.01X C:\ntop\dependencies\nDPI\example\pcapExample\pcapExample\pcapExample.cpp!pFSdBookmarkState+(TaskListShortcuts$,OutliningStateEx1$,-OutliningStateEx8$%0bC:\ntop\dependencies\nDPI\src\include\ndpi_main.h8xO ]1 dC:\ntop\Source\Copia di ntop\utils\getopt\getopt.h my~O.sdC:\ntop\dependencies\nDPI\src\lib\protocols\dhcp.cܫ>cֽ1QOutliningStateEx6$*3OutliningStateEx9$+6OutliningStateEx2$9OutliningStateEx16&-/<\C:\ntop\dependencies\nDPI\example\pcapReader.cg;R7Lnu m+ZC:\ntop\dependencies\nDPI\src\lib\ndpi_main.c;8eLe:jEC:\ntop\dependencies\nDPI\example\pcapExample\pcapExampVsToolboxService">XmlPackageOptions$#?OutliningStateEx19&poOutliningStateEx18& role\netbios.objAC:\ntop\dependencies\nDPI\example\pcapExample\pcapExample\dns.objC:\ntop\nprobe\nProbe\nprobe_win32.c<open> c:\program files\microsoft visual studio 10.0\vc\include\string.h<open> c:\Program Files\Microsoft SDKs\Windows\v7.0A\Include\WinSock2.h<open> m icrosoft visual studio 1\ntop\dependencies\nDPI\src\include\ndpi_main.hnC:\ntop\dependencies\nDPI\src\lib\protocols\postgres.cNC:\ntop\nprobe\nprobe-win-32\getopt1.clC:\ntop\dependencies\nDPI\src\lib\protocols\netflow.cc:\program filesD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}B|D:0:0:{6AD4397B-B4EF-4CDD-9C56-AC7E2100A69B}|nprobe.vcxproj|C:\ntop\nprobe\VERSION.C||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\example\pcapReader.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\nprobe\nprobe-win-32\getopt1.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}IBD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\nprobe\nprobe-win-32\getopt.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\ndpi_main.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}$DD:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}||C:\ntop\nprobe\nProbe\nprobe_win32.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}HXDD:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}||c:\Program Files\Microsoft SDKs\Windows\v7.0A\Include\WinSock2.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\third_party\src\ahocorasick.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\http.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}QeDD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\ssl.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}ZeDD:0:0:{A2FE74E1-B743-11D0-AE1A-00A0C90FFFC3}||c:\program files\microsoft visual studio 10.0\vc\include\string.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}࿻DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\include\ndpi_protocols.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}BD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\dhcp.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}BD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\include\ndpi_main.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\dns.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}PeDD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\include\linux_compat.h||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}!/DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\netflow.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}+&2DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxproj|C:\ntop\dependencies\nDPI\src\lib\protocols\postgres.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}\&cies\nDPI\src\lib\protocols\netflow.c||{D0E1A5C6-B359-4E41-9B60-3365922C2A22}+&2DD:0:0:{F6A2C0AE-2110-438A-87E4-7C1CFCE064C6}|pcapExample\pcapExample.vcxprOutliningStateEx20&tqOutliningStateEx7$vOutliningStateEx14&(yOutliningStateEx13&|\microsoft visual studio 10.0\vc\include\string.h nC:\ntop\dependencies\nDPI\src\include\ndpi_protocols.h dC:\ntop\dependencies\nDPI\src\lib\protocols\ssl.c ^C:\ntop\dependencies\nDPI\example\pcapReader.c\C:\ntop\dependencies\nDPI\src\lib\ndpi_main.cfC:\ntop\dependencies\nDPI\src\lib\protocols\dhcp.c JC:\ntop\nprobe\nProbe\nprobe_win32.cLC:\ntop\nprobe\nprobe-win-32\getopt.cC:\ntop\dependencies\nDPI\src\lib\third_party\src\ahocorasick.cfC:\ntop\dependencies\nDPI\src\lib\protocols\http.c dC:\ntop\dependencies\nDPI\src\lib\protocols\dns.cLC:\ntop\nprobe\nprobe-win-32\getopt.hc:\Program Files\Microsoft SDKs\Windows\v7.0A\Include\WinSock2.he\nprobe-win-32\getopt.}.dwStartupOpt=; ActiveCfg= Debug|Win32;0A\Include\WinSoC1CFCE064C6}=Debug|Win32Ks\Windows\v7.0A\Include\WinSock2.hLC:\ntop\nprobe\nprobe-win-32\getopt.hprotocols\dns.cLC:\ntop\nprobe\nprobe-win-32\getopt.hc:\Program Files\Microsoft SDKs\Windows\v7.0A\Include\WinSock2.hJC:\ntop\nprobe\nprobe-win-32\getopt.hL!Ouq걸JC:\ntop\nprobe\nprobe-win-32\getopt.cEmgA??_ ;LC:\ntop\nprobe\nprobe-win-32\getopt1.c^НR0nգ" bC:\ntop\dependencies\nDPI\src\lib\protocols\dns.cm7JWrJ,: ~C:\ntop\dependencies\nDPI\src\lib\third_party\src\ahocorasick.c{kB+cfBa2U`dC:\ntop\dependencies\nDPI\src\lib\protocols\http.cxHiu=>]SbC:\ntop\dependencies\nDPI\src\liOutliningStateEx12&.'OutliningStateEx10&&OutliningStateEx5$OutliningStateEx4$b\protocols\ssl.c{'P9CElC:\ntop\dependencies\nDPI\src\include\ndpi_protocols.h+XohC:\ntop\dependencies\nDPI\src\include\linux_compat.h O^X%'&A/m/jC:\ntop\dependencies\nDPI\src\lib\protocols\netflow.cp &SXѩlC:\ntop\dependencies\nDPI\src\lib\protocols\postgres.cS0UrKkc:\Program Files\Microsoft SDKs\Windows\v7.0A\Include\WinSock2.OutliningStateEx3$OutliningStateEx15&OutliningStateEx11&OutliningStateEx17&mh;OA[c:\program files\microsoft visual studio 10.0\vc\include\string.hkhHPT39HC:\ntop\nprobe\nProbe\nprobe_win32.c@\-0.8nDPI-2.2/example/Win32/pcapExample/000077500000000000000000000000001321103654100167375ustar00rootroot00000000000000nDPI-2.2/example/Win32/pcapExample/pcapExample.cpp000066400000000000000000000002441321103654100217020ustar00rootroot00000000000000// pcapExample.cpp : Defines the entry point for the console application. // #include "stdafx.h" int _tmain(int argc, _TCHAR* argv[]) { return 0; } nDPI-2.2/example/Win32/pcapExample/pcapExample.vcxproj000066400000000000000000000333771321103654100226300ustar00rootroot00000000000000 Debug Win32 Release Win32 {F6A2C0AE-2110-438A-87E4-7C1CFCE064C6} Win32Proj pcapExample Application true Unicode Application false true Unicode true false NotUsing Level3 Disabled WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) C:\ntop\nprobe\nprobe-win-32;C:\ntop\winpcap\Include;C:\ntop\dependencies\nDPI\src\lib\third_party\include;C:\ntop\dependencies\nDPI\src\include;%(AdditionalIncludeDirectories) Console true Wsock32.lib;Ws2_32.lib;C:\ntop\winpcap\Lib\Packet.lib;C:\ntop\winpcap\Lib\wpcap.lib;%(AdditionalDependencies) Level3 Use MaxSpeed true true WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) Console true true true nDPI-2.2/example/Win32/pcapExample/pcapExample.vcxproj.filters000066400000000000000000000441001321103654100242610ustar00rootroot00000000000000 {4FC737F1-C7A5-4376-A066-2A32D752A2FF} cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx {93995380-89BD-4b04-88EB-625FBE52EBFB} h;hpp;hxx;hm;inl;inc;xsd {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Source Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files Header Files nDPI-2.2/example/Win32/pcapExample/pcapExample.vcxproj.user000066400000000000000000000002171321103654100235700ustar00rootroot00000000000000 nDPI-2.2/example/ndpiReader.c000066400000000000000000003112131321103654100160200ustar00rootroot00000000000000/* * ndpiReader.c * * Copyright (C) 2011-17 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifdef linux #define _GNU_SOURCE #include #endif #include #include #include #ifdef WIN32 #include /* winsock.h is included automatically */ #include #include #define getopt getopt____ #else #include #include #endif #include #include #include #include #include #include #include #include #include #include "../config.h" #include "ndpi_api.h" #include "uthash.h" #include #include #include #include #ifdef HAVE_JSON_C #include #endif #include "ndpi_util.h" /** Client parameters **/ static char *_pcap_file[MAX_NUM_READER_THREADS]; /**< Ingress pcap file/interfaces */ static FILE *playlist_fp[MAX_NUM_READER_THREADS] = { NULL }; /**< Ingress playlist */ static FILE *results_file = NULL; static char *results_path = NULL; static char * bpfFilter = NULL; /**< bpf filter */ static char *_protoFilePath = NULL; /**< Protocol file path */ #ifdef HAVE_JSON_C static char *_statsFilePath = NULL; /**< Top stats file path */ static char *_diagnoseFilePath = NULL; /**< Top stats file path */ static char *_jsonFilePath = NULL; /**< JSON file path */ static FILE *stats_fp = NULL; /**< for Top Stats JSON file */ #endif #ifdef HAVE_JSON_C static json_object *jArray_known_flows, *jArray_unknown_flows; static json_object *jArray_topStats; #endif static u_int8_t live_capture = 0; static u_int8_t undetected_flows_deleted = 0; /** User preferences **/ static u_int8_t enable_protocol_guess = 1, verbose = 0, nDPI_traceLevel = 0, json_flag = 0; static u_int8_t stats_flag = 0, bpf_filter_flag = 0; #ifdef HAVE_JSON_C static u_int8_t file_first_time = 1; #endif static u_int32_t pcap_analysis_duration = (u_int32_t)-1; static u_int16_t decode_tunnels = 0; static u_int16_t num_loops = 1; static u_int8_t shutdown_app = 0, quiet_mode = 0; static u_int8_t num_threads = 1; static struct timeval begin, end; #ifdef linux static int core_affinity[MAX_NUM_READER_THREADS]; #endif static struct timeval pcap_start, pcap_end; /** Detection parameters **/ static time_t capture_for = 0; static time_t capture_until = 0; static u_int32_t num_flows; static struct ndpi_detection_module_struct *ndpi_info_mod = NULL; struct flow_info { struct ndpi_flow_info *flow; u_int16_t thread_id; }; static struct flow_info *all_flows; struct info_pair { u_int32_t addr; u_int8_t version; /* IP version */ char proto[16]; /*app level protocol*/ int count; }; typedef struct node_a{ u_int32_t addr; u_int8_t version; /* IP version */ char proto[16]; /*app level protocol*/ int count; struct node_a *left, *right; }addr_node; struct port_stats { u_int32_t port; /* we'll use this field as the key */ u_int32_t num_pkts, num_bytes; u_int32_t num_flows; u_int32_t num_addr; /*number of distinct IP addresses */ u_int32_t cumulative_addr; /*cumulative some of IP addresses */ addr_node *addr_tree; /* tree of distinct IP addresses */ struct info_pair top_ip_addrs[MAX_NUM_IP_ADDRESS]; u_int8_t hasTopHost; /* as boolean flag*/ u_int32_t top_host; /*host that is contributed to > 95% of traffic*/ u_int8_t version; /* top host's ip version */ char proto[16]; /*application level protocol of top host */ UT_hash_handle hh; /* makes this structure hashable */ }; struct port_stats *srcStats = NULL, *dstStats = NULL; // struct to hold count of flows received by destination ports struct port_flow_info { u_int32_t port; /* key */ u_int32_t num_flows; UT_hash_handle hh; }; // struct to hold single packet tcp flows sent by source ip address struct single_flow_info { u_int32_t saddr; /* key */ u_int8_t version; /* IP version */ struct port_flow_info *ports; u_int32_t tot_flows; UT_hash_handle hh; }; struct single_flow_info *scannerHosts = NULL; // struct to hold top receiver hosts struct receiver { u_int32_t addr; /* key */ u_int8_t version; /* IP version */ u_int32_t num_pkts; UT_hash_handle hh; }; struct receiver *receivers = NULL, *topReceivers = NULL; struct ndpi_packet_trailer { u_int32_t magic; /* 0x19682017 */ u_int16_t master_protocol /* e.g. HTTP */, app_protocol /* e.g. FaceBook */; char name[16]; }; static pcap_dumper_t *extcap_dumper = NULL; static char extcap_buf[16384]; static char *extcap_capture_fifo = NULL; static u_int16_t extcap_packet_filter = (u_int16_t)-1; // struct associated to a workflow for a thread struct reader_thread { struct ndpi_workflow *workflow; pthread_t pthread; u_int64_t last_idle_scan_time; u_int32_t idle_scan_idx; u_int32_t num_idle_flows; struct ndpi_flow_info *idle_flows[IDLE_SCAN_BUDGET]; }; // array for every thread created for a flow static struct reader_thread ndpi_thread_info[MAX_NUM_READER_THREADS]; // ID tracking typedef struct ndpi_id { u_int8_t ip[4]; // Ip address struct ndpi_id_struct *ndpi_id; // nDpi worker structure } ndpi_id_t; // used memory counters u_int32_t current_ndpi_memory = 0, max_ndpi_memory = 0; void test_lib(); /* Forward */ /* ********************************** */ #ifdef DEBUG_TRACE FILE *trace = NULL; #endif /********************** FUNCTIONS ********************* */ /** * @brief Set main components necessary to the detection */ static void setupDetection(u_int16_t thread_id, pcap_t * pcap_handle); /** * @brief Print help instructions */ static void help(u_int long_help) { printf("Welcome to nDPI %s\n\n", ndpi_revision()); printf("ndpiReader -i [-f ][-s ][-m ]\n" " [-p ][-l [-q][-d][-h][-t][-v ]\n" " [-n ] [-w ] [-j ] [-x ] \n\n" "Usage:\n" " -i | Specify a pcap file/playlist to read packets from or a\n" " | device for live capture (comma-separated list)\n" " -f | Specify a BPF filter for filtering selected traffic\n" " -s | Maximum capture duration in seconds (live traffic capture only)\n" " -m | Split analysis duration in max seconds\n" " -p .protos | Specify a protocol file (eg. protos.txt)\n" " -l | Number of detection loops (test only)\n" " -n | Number of threads. Default: number of interfaces in -i.\n" " | Ignored with pcap files.\n" " -j | Specify a file to write the content of packets in .json format\n" #ifdef linux " -g | Thread affinity mask (one core id per thread)\n" #endif " -d | Disable protocol guess and use only DPI\n" " -q | Quiet mode\n" " -t | Dissect GTP/TZSP tunnels\n" " -r | Print nDPI version and git revision\n" " -w | Write test output on the specified file. This is useful for\n" " | testing purposes in order to compare results across runs\n" " -h | This help\n" " -v <1|2|3> | Verbose 'unknown protocol' packet print.\n" " | 1 = verbose\n" " | 2 = very verbose\n" " | 3 = port stats\n" " -b | Specify a file to write port based diagnose statistics\n" " -x | Produce bpf filters for specified diagnose file. Use\n" " | this option only for .json files generated with -b flag.\n"); #ifndef WIN32 printf("\nExcap (wireshark) options:\n" " --extcap-interfaces\n" " --extcap-version\n" " --extcap-dlts\n" " --extcap-interface \n" " --extcap-config\n" " --capture\n" " --extcap-capture-filter\n" " --fifo \n" " --debug\n" ); #endif if(long_help) { printf("\n\nSupported protocols:\n"); num_threads = 1; ndpi_dump_protocols(ndpi_info_mod); } exit(!long_help); } static struct option longopts[] = { /* mandatory extcap options */ { "extcap-interfaces", no_argument, NULL, '0'}, { "extcap-version", optional_argument, NULL, '1'}, { "extcap-dlts", no_argument, NULL, '2'}, { "extcap-interface", required_argument, NULL, '3'}, { "extcap-config", no_argument, NULL, '4'}, { "capture", no_argument, NULL, '5'}, { "extcap-capture-filter", required_argument, NULL, '6'}, { "fifo", required_argument, NULL, '7'}, { "debug", optional_argument, NULL, '8'}, { "ndpi-proto-filter", required_argument, NULL, '9'}, /* ndpiReader options */ { "enable-protocol-guess", no_argument, NULL, 'd'}, { "interface", required_argument, NULL, 'i'}, { "filter", required_argument, NULL, 'f'}, { "cpu-bind", required_argument, NULL, 'g'}, { "loops", required_argument, NULL, 'l'}, { "num-threads", required_argument, NULL, 'n'}, { "protos", required_argument, NULL, 'p'}, { "capture-duration", required_argument, NULL, 's'}, { "decode-tunnels", no_argument, NULL, 't'}, { "revision", no_argument, NULL, 'r'}, { "verbose", no_argument, NULL, 'v'}, { "version", no_argument, NULL, 'V'}, { "help", no_argument, NULL, 'h'}, { "json", required_argument, NULL, 'j'}, { "result-path", required_argument, NULL, 'w'}, { "quiet", no_argument, NULL, 'q'}, {0, 0, 0, 0} }; /* ********************************** */ void extcap_interfaces() { printf("extcap {version=%s}\n", ndpi_revision()); printf("interface {value=ndpi}{display=nDPI interface}\n"); exit(0); } /* ********************************** */ void extcap_dlts() { u_int dlts_number = DLT_EN10MB; printf("dlt {number=%u}{name=%s}{display=%s}\n", dlts_number, "ndpi", "nDPI Interface"); exit(0); } /* ********************************** */ struct ndpi_proto_sorter { int id; char name[16]; }; int cmpProto(const void *_a, const void *_b) { struct ndpi_proto_sorter *a = (struct ndpi_proto_sorter*)_a; struct ndpi_proto_sorter *b = (struct ndpi_proto_sorter*)_b; return(strcmp(a->name, b->name)); } int cmpFlows(const void *_a, const void *_b) { struct ndpi_flow_info *fa = ((struct flow_info*)_a)->flow; struct ndpi_flow_info *fb = ((struct flow_info*)_b)->flow; uint64_t a_size = fa->src2dst_bytes + fa->dst2src_bytes; uint64_t b_size = fb->src2dst_bytes + fb->dst2src_bytes; if(a_size != b_size) return a_size < b_size ? 1 : -1; // copy from ndpi_workflow_node_cmp(); if(fa->ip_version < fb->ip_version ) return(-1); else { if(fa->ip_version > fb->ip_version ) return(1); } if(fa->protocol < fb->protocol ) return(-1); else { if(fa->protocol > fb->protocol ) return(1); } if(htonl(fa->src_ip) < htonl(fb->src_ip) ) return(-1); else { if(htonl(fa->src_ip) > htonl(fb->src_ip) ) return(1); } if(htons(fa->src_port) < htons(fb->src_port)) return(-1); else { if(htons(fa->src_port) > htons(fb->src_port)) return(1); } if(htonl(fa->dst_ip) < htonl(fb->dst_ip) ) return(-1); else { if(htonl(fa->dst_ip) > htonl(fb->dst_ip) ) return(1); } if(htons(fa->dst_port) < htons(fb->dst_port)) return(-1); else { if(htons(fa->dst_port) > htons(fb->dst_port)) return(1); } return(0); } void extcap_config() { int i, argidx = 0; struct ndpi_proto_sorter *protos; /* -i */ printf("arg {number=%d}{call=-i}{display=Capture Interface}{type=string}" "{tooltip=The interface name}\n", argidx++); printf("arg {number=%d}{call=-i}{display=Pcap File to Analyze}{type=fileselect}" "{tooltip=The pcap file to analyze (if the interface is unspecified)}\n", argidx++); protos = (struct ndpi_proto_sorter*)malloc(sizeof(struct ndpi_proto_sorter) * ndpi_info_mod->ndpi_num_supported_protocols); if(!protos) exit(0); for(i=0; i<(int) ndpi_info_mod->ndpi_num_supported_protocols; i++) { protos[i].id = i; snprintf(protos[i].name, sizeof(protos[i].name), "%s", ndpi_info_mod->proto_defaults[i].protoName); } qsort(protos, ndpi_info_mod->ndpi_num_supported_protocols, sizeof(struct ndpi_proto_sorter), cmpProto); printf("arg {number=%d}{call=-9}{display=nDPI Protocol Filter}{type=selector}" "{tooltip=nDPI Protocol to be filtered}\n", argidx); printf("value {arg=%d}{value=%d}{display=%s}\n", argidx, -1, "All Protocols (no nDPI filtering)"); for(i=0; i<(int)ndpi_info_mod->ndpi_num_supported_protocols; i++) printf("value {arg=%d}{value=%d}{display=%s (%d)}\n", argidx, protos[i].id, protos[i].name, protos[i].id); free(protos); exit(0); } /* ********************************** */ void extcap_capture() { #ifdef DEBUG_TRACE if(trace) fprintf(trace, " #### %s #### \n", __FUNCTION__); #endif if((extcap_dumper = pcap_dump_open(pcap_open_dead(DLT_EN10MB, 16384 /* MTU */), extcap_capture_fifo)) == NULL) { fprintf(stderr, "Unable to open the pcap dumper on %s", extcap_capture_fifo); #ifdef DEBUG_TRACE if(trace) fprintf(trace, "Unable to open the pcap dumper on %s\n", extcap_capture_fifo); #endif return; } #ifdef DEBUG_TRACE if(trace) fprintf(trace, "Starting packet capture [%p]\n", extcap_dumper); #endif } /* ********************************** */ /** * @brief Option parser */ static void parseOptions(int argc, char **argv) { int option_idx = 0, do_capture = 0; char *__pcap_file = NULL, *bind_mask = NULL; int thread_id, opt; #ifdef linux u_int num_cores = sysconf(_SC_NPROCESSORS_ONLN); #endif #ifdef DEBUG_TRACE trace = fopen("/tmp/ndpiReader.log", "a"); if(trace) fprintf(trace, " #### %s #### \n", __FUNCTION__); #endif while ((opt = getopt_long(argc, argv, "df:g:i:hp:l:s:tv:V:n:j:rp:w:q0123:456:7:89:m:b:x:", longopts, &option_idx)) != EOF) { #ifdef DEBUG_TRACE if(trace) fprintf(trace, " #### -%c [%s] #### \n", opt, optarg ? optarg : ""); #endif switch (opt) { case 'd': enable_protocol_guess = 0; break; case 'i': case '3': _pcap_file[0] = optarg; break; case 'b': #ifndef HAVE_JSON_C printf("WARNING: this copy of ndpiReader has been compiled without JSON-C: json export disabled\n"); #else _statsFilePath = optarg; stats_flag = 1; #endif break; case 'm': pcap_analysis_duration = atol(optarg); break; case 'x': #ifndef HAVE_JSON_C printf("WARNING: this copy of ndpiReader has been compiled without JSON-C: json export disabled\n"); #else _diagnoseFilePath = optarg; bpf_filter_flag = 1; #endif break; case 'f': case '6': bpfFilter = optarg; break; case 'g': bind_mask = optarg; break; case 'l': num_loops = atoi(optarg); break; case 'n': num_threads = atoi(optarg); break; case 'p': _protoFilePath = optarg; break; case 's': capture_for = atoi(optarg); capture_until = capture_for + time(NULL); break; case 't': decode_tunnels = 1; break; case 'r': printf("ndpiReader - nDPI (%s)\n", ndpi_revision()); exit(0); case 'v': verbose = atoi(optarg); break; case 'V': printf("%d\n",atoi(optarg) ); nDPI_traceLevel = atoi(optarg); break; case 'h': help(1); break; case 'j': #ifndef HAVE_JSON_C printf("WARNING: this copy of ndpiReader has been compiled without JSON-C: json export disabled\n"); #else _jsonFilePath = optarg; json_flag = 1; #endif break; case 'w': results_path = strdup(optarg); if((results_file = fopen(results_path, "w")) == NULL) { printf("Unable to write in file %s: quitting\n", results_path); return; } break; case 'q': quiet_mode = 1; break; /* Extcap */ case '0': extcap_interfaces(); break; case '1': printf("extcap {version=%s}\n", ndpi_revision()); break; case '2': extcap_dlts(); break; case '4': extcap_config(); break; case '5': do_capture = 1; break; case '7': extcap_capture_fifo = strdup(optarg); break; case '8': nDPI_traceLevel = 9; break; case '9': extcap_packet_filter = ndpi_get_proto_by_name(ndpi_info_mod, optarg); if (extcap_packet_filter == NDPI_PROTOCOL_UNKNOWN) extcap_packet_filter = atoi(optarg); break; default: help(0); break; } } if(!bpf_filter_flag) { if(do_capture) { quiet_mode = 1; extcap_capture(); } // check parameters if(!bpf_filter_flag && (_pcap_file[0] == NULL || strcmp(_pcap_file[0], "") == 0)) { help(0); } if(strchr(_pcap_file[0], ',')) { /* multiple ingress interfaces */ num_threads = 0; /* setting number of threads = number of interfaces */ __pcap_file = strtok(_pcap_file[0], ","); while (__pcap_file != NULL && num_threads < MAX_NUM_READER_THREADS) { _pcap_file[num_threads++] = __pcap_file; __pcap_file = strtok(NULL, ","); } } else { if(num_threads > MAX_NUM_READER_THREADS) num_threads = MAX_NUM_READER_THREADS; for(thread_id = 1; thread_id < num_threads; thread_id++) _pcap_file[thread_id] = _pcap_file[0]; } #ifdef linux for(thread_id = 0; thread_id < num_threads; thread_id++) core_affinity[thread_id] = -1; if(num_cores > 1 && bind_mask != NULL) { char *core_id = strtok(bind_mask, ":"); thread_id = 0; while (core_id != NULL && thread_id < num_threads) { core_affinity[thread_id++] = atoi(core_id) % num_cores; core_id = strtok(NULL, ":"); } } #endif } #ifdef DEBUG_TRACE if(trace) fclose(trace); #endif } /** * @brief From IPPROTO to string NAME */ static char* ipProto2Name(u_int16_t proto_id) { static char proto[8]; switch(proto_id) { case IPPROTO_TCP: return("TCP"); break; case IPPROTO_UDP: return("UDP"); break; case IPPROTO_ICMP: return("ICMP"); break; case IPPROTO_ICMPV6: return("ICMPV6"); break; case 112: return("VRRP"); break; case IPPROTO_IGMP: return("IGMP"); break; } snprintf(proto, sizeof(proto), "%u", proto_id); return(proto); } /** * @brief A faster replacement for inet_ntoa(). */ char* intoaV4(u_int32_t addr, char* buf, u_int16_t bufLen) { char *cp, *retStr; uint byte; int n; cp = &buf[bufLen]; *--cp = '\0'; n = 4; do { byte = addr & 0xff; *--cp = byte % 10 + '0'; byte /= 10; if(byte > 0) { *--cp = byte % 10 + '0'; byte /= 10; if(byte > 0) *--cp = byte + '0'; } *--cp = '.'; addr >>= 8; } while (--n > 0); /* Convert the string to lowercase */ retStr = (char*)(cp+1); return(retStr); } /** * @brief Print the flow */ static void printFlow(u_int16_t id, struct ndpi_flow_info *flow, u_int16_t thread_id) { #ifdef HAVE_JSON_C json_object *jObj; #endif FILE *out = results_file ? results_file : stdout; if((verbose != 1) && (verbose != 2)) return; if(!json_flag) { fprintf(out, "\t%u", id); fprintf(out, "\t%s ", ipProto2Name(flow->protocol)); fprintf(out, "%s%s%s:%u %s %s%s%s:%u ", (flow->ip_version == 6) ? "[" : "", flow->src_name, (flow->ip_version == 6) ? "]" : "", ntohs(flow->src_port), flow->bidirectional ? "<->" : "->", (flow->ip_version == 6) ? "[" : "", flow->dst_name, (flow->ip_version == 6) ? "]" : "", ntohs(flow->dst_port) ); if(flow->vlan_id > 0) fprintf(out, "[VLAN: %u]", flow->vlan_id); if(flow->detected_protocol.master_protocol) { char buf[64]; fprintf(out, "[proto: %u.%u/%s]", flow->detected_protocol.master_protocol, flow->detected_protocol.app_protocol, ndpi_protocol2name(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol, buf, sizeof(buf))); } else fprintf(out, "[proto: %u/%s]", flow->detected_protocol.app_protocol, ndpi_get_proto_name(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol.app_protocol)); fprintf(out, "[%u pkts/%llu bytes ", flow->src2dst_packets, (long long unsigned int) flow->src2dst_bytes); fprintf(out, "%s %u pkts/%llu bytes]", (flow->dst2src_packets > 0) ? "<->" : "->", flow->dst2src_packets, (long long unsigned int) flow->dst2src_bytes); if(flow->host_server_name[0] != '\0') fprintf(out, "[Host: %s]", flow->host_server_name); if(flow->info[0] != '\0') fprintf(out, "[%s]", flow->info); if(flow->ssh_ssl.client_info[0] != '\0') fprintf(out, "[client: %s]", flow->ssh_ssl.client_info); if(flow->ssh_ssl.server_info[0] != '\0') fprintf(out, "[server: %s]", flow->ssh_ssl.server_info); if(flow->bittorent_hash[0] != '\0') fprintf(out, "[BT Hash: %s]", flow->bittorent_hash); fprintf(out, "\n"); } else { #ifdef HAVE_JSON_C jObj = json_object_new_object(); json_object_object_add(jObj,"protocol",json_object_new_string(ipProto2Name(flow->protocol))); json_object_object_add(jObj,"host_a.name",json_object_new_string(flow->src_name)); json_object_object_add(jObj,"host_a.port",json_object_new_int(ntohs(flow->src_port))); json_object_object_add(jObj,"host_b.name",json_object_new_string(flow->dst_name)); json_object_object_add(jObj,"host_b.port",json_object_new_int(ntohs(flow->dst_port))); if(flow->detected_protocol.master_protocol) json_object_object_add(jObj,"detected.master_protocol",json_object_new_int(flow->detected_protocol.master_protocol)); json_object_object_add(jObj,"detected.app_protocol",json_object_new_int(flow->detected_protocol.app_protocol)); if(flow->detected_protocol.master_protocol) { char tmp[256]; snprintf(tmp, sizeof(tmp), "%s.%s", ndpi_get_proto_name(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol.master_protocol), ndpi_get_proto_name(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol.app_protocol)); json_object_object_add(jObj,"detected.protocol.name", json_object_new_string(tmp)); } else json_object_object_add(jObj,"detected.protocol.name", json_object_new_string(ndpi_get_proto_name(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol.app_protocol))); json_object_object_add(jObj,"packets",json_object_new_int(flow->src2dst_packets + flow->dst2src_packets)); json_object_object_add(jObj,"bytes",json_object_new_int(flow->src2dst_bytes + flow->dst2src_bytes)); if(flow->host_server_name[0] != '\0') json_object_object_add(jObj,"host.server.name",json_object_new_string(flow->host_server_name)); if((flow->ssh_ssl.client_info[0] != '\0') || (flow->ssh_ssl.server_info[0] != '\0')) { json_object *sjObj = json_object_new_object(); if(flow->ssh_ssl.client_info[0] != '\0') json_object_object_add(sjObj, "client", json_object_new_string(flow->ssh_ssl.client_info)); if(flow->ssh_ssl.server_info[0] != '\0') json_object_object_add(sjObj, "server", json_object_new_string(flow->ssh_ssl.server_info)); json_object_object_add(jObj, "ssh_ssl", sjObj); } if(json_flag == 1) json_object_array_add(jArray_known_flows,jObj); else if(json_flag == 2) json_object_array_add(jArray_unknown_flows,jObj); #endif } } /** * @brief Unknown Proto Walker */ static void node_print_unknown_proto_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) { struct ndpi_flow_info *flow = *(struct ndpi_flow_info**)node; u_int16_t thread_id = *((u_int16_t*)user_data); if(flow->detected_protocol.app_protocol != NDPI_PROTOCOL_UNKNOWN) return; if((which == ndpi_preorder) || (which == ndpi_leaf)) { /* Avoid walking the same node multiple times */ all_flows[num_flows].thread_id = thread_id, all_flows[num_flows].flow = flow; num_flows++; } } /** * @brief Known Proto Walker */ static void node_print_known_proto_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) { struct ndpi_flow_info *flow = *(struct ndpi_flow_info**)node; u_int16_t thread_id = *((u_int16_t*)user_data); if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) return; if((which == ndpi_preorder) || (which == ndpi_leaf)) { /* Avoid walking the same node multiple times */ all_flows[num_flows].thread_id = thread_id, all_flows[num_flows].flow = flow; num_flows++; } } /** * @brief Guess Undetected Protocol */ static u_int16_t node_guess_undetected_protocol(u_int16_t thread_id, struct ndpi_flow_info *flow) { flow->detected_protocol = ndpi_guess_undetected_protocol(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->protocol, ntohl(flow->src_ip), ntohs(flow->src_port), ntohl(flow->dst_ip), ntohs(flow->dst_port)); // printf("Guess state: %u\n", flow->detected_protocol); if(flow->detected_protocol.app_protocol != NDPI_PROTOCOL_UNKNOWN) ndpi_thread_info[thread_id].workflow->stats.guessed_flow_protocols++; return(flow->detected_protocol.app_protocol); } /** * @brief Proto Guess Walker */ static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) { struct ndpi_flow_info *flow = *(struct ndpi_flow_info **) node; u_int16_t thread_id = *((u_int16_t *) user_data); if((which == ndpi_preorder) || (which == ndpi_leaf)) { /* Avoid walking the same node multiple times */ if((!flow->detection_completed) && flow->ndpi_flow) flow->detected_protocol = ndpi_detection_giveup(ndpi_thread_info[0].workflow->ndpi_struct, flow->ndpi_flow); if(enable_protocol_guess) { if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) { node_guess_undetected_protocol(thread_id, flow); } } process_ndpi_collected_info(ndpi_thread_info[thread_id].workflow, flow); ndpi_thread_info[thread_id].workflow->stats.protocol_counter[flow->detected_protocol.app_protocol] += flow->src2dst_packets + flow->dst2src_packets; ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes[flow->detected_protocol.app_protocol] += flow->src2dst_bytes + flow->dst2src_bytes; ndpi_thread_info[thread_id].workflow->stats.protocol_flows[flow->detected_protocol.app_protocol]++; } } /* *********************************************** */ void updateScanners(struct single_flow_info **scanners, u_int32_t saddr, u_int8_t version, u_int32_t dport) { struct single_flow_info *f; struct port_flow_info *p; HASH_FIND_INT(*scanners, (int *)&saddr, f); if(f == NULL) { f = (struct single_flow_info*)malloc(sizeof(struct single_flow_info)); if(!f) return; f->saddr = saddr; f->version = version; f->tot_flows = 1; f->ports = NULL; p = (struct port_flow_info*)malloc(sizeof(struct port_flow_info)); if(!p) { free(f); return; } else p->port = dport, p->num_flows = 1; HASH_ADD_INT(f->ports, port, p); HASH_ADD_INT(*scanners, saddr, f); } else{ struct port_flow_info *pp; f->tot_flows++; HASH_FIND_INT(f->ports, (int *)&dport, pp); if(pp == NULL) { pp = (struct port_flow_info*)malloc(sizeof(struct port_flow_info)); if(!pp) return; pp->port = dport, pp->num_flows = 1; HASH_ADD_INT(f->ports, port, pp); } else pp->num_flows++; } } /* *********************************************** */ int updateIpTree(u_int32_t key, u_int8_t version, addr_node **vrootp, const char *proto) { addr_node *q; addr_node **rootp = vrootp; if(rootp == (addr_node **)0) return 0; while (*rootp != (addr_node *)0) { /* Knuth's T1: */ if((version == (*rootp)->version) && (key == (*rootp)->addr)) { /* T2: */ return ++((*rootp)->count); } rootp = (key < (*rootp)->addr) ? &(*rootp)->left : /* T3: follow left branch */ &(*rootp)->right; /* T4: follow right branch */ } q = (addr_node *) malloc(sizeof(addr_node)); /* T5: key not found */ if(q != (addr_node *)0) { /* make new node */ *rootp = q; /* link new node to old */ q->addr = key; q->version = version; strncpy(q->proto, proto, sizeof(q->proto)); q->count = UPDATED_TREE; q->left = q->right = (addr_node *)0; return q->count; } return(0); } /* *********************************************** */ void freeIpTree(addr_node *root) { if (root == NULL) return; freeIpTree(root->left); freeIpTree(root->right); free(root); root = NULL; } /* *********************************************** */ void updateTopIpAddress(u_int32_t addr, u_int8_t version, const char *proto, int count, struct info_pair top[], int size) { struct info_pair pair; int min = count; int update = 0; int min_i = 0; int r; int i; if(count == 0) return; pair.addr = addr; pair.version = version; pair.count = count; strncpy(pair.proto, proto, sizeof(pair.proto)); for(i=0; iport = port, s->num_pkts = num_pkts, s->num_bytes = num_bytes; s->num_addr = 1, s->cumulative_addr = 1; s->num_flows = 1; updateTopIpAddress(addr, version, proto, 1, s->top_ip_addrs, MAX_NUM_IP_ADDRESS); s->addr_tree = (addr_node *) malloc(sizeof(addr_node)); if(!s->addr_tree) { free(s); return; } s->addr_tree->addr = addr; s->addr_tree->version = version; strncpy(s->addr_tree->proto, proto, sizeof(s->addr_tree->proto)); s->addr_tree->count = 1; s->addr_tree->left = NULL; s->addr_tree->right = NULL; HASH_ADD_INT(*stats, port, s); } else{ count = updateIpTree(addr, version, &(*s).addr_tree, proto); if(count == UPDATED_TREE) s->num_addr++; if(count) { s->cumulative_addr++; updateTopIpAddress(addr, version, proto, count, s->top_ip_addrs, MAX_NUM_IP_ADDRESS); } s->num_pkts += num_pkts, s->num_bytes += num_bytes, s->num_flows++; } } /* *********************************************** */ /* @brief heuristic choice for receiver stats */ static int acceptable(u_int32_t num_pkts){ return num_pkts > 5; } /* *********************************************** */ static int receivers_sort(void *_a, void *_b) { struct receiver *a = (struct receiver *)_a; struct receiver *b = (struct receiver *)_b; return(b->num_pkts - a->num_pkts); } /* *********************************************** */ static int receivers_sort_asc(void *_a, void *_b) { struct receiver *a = (struct receiver *)_a; struct receiver *b = (struct receiver *)_b; return(a->num_pkts - b->num_pkts); } /* ***************************************************** */ /*@brief removes first (size - max) elements from hash table. * hash table is ordered in ascending order. */ static struct receiver *cutBackTo(struct receiver **receivers, u_int32_t size, u_int32_t max) { struct receiver *r, *tmp; int i=0; int count; if(size < max) //return the original table return *receivers; count = size - max; HASH_ITER(hh, *receivers, r, tmp) { if(i++ == count) return r; HASH_DEL(*receivers, r); free(r); } return(NULL); } /* *********************************************** */ /*@brief merge first table to the second table. * if element already in the second table * then updates its value * else adds it to the second table */ static void mergeTables(struct receiver **primary, struct receiver **secondary) { struct receiver *r, *s, *tmp; HASH_ITER(hh, *primary, r, tmp) { HASH_FIND_INT(*secondary, (int *)&(r->addr), s); if(s == NULL){ s = (struct receiver *)malloc(sizeof(struct receiver)); if(!s) return; s->addr = r->addr; s->version = r->version; s->num_pkts = r->num_pkts; HASH_ADD_INT(*secondary, addr, s); } else s->num_pkts += r->num_pkts; HASH_DEL(*primary, r); free(r); } } /* *********************************************** */ static void deleteReceivers(struct receiver *receivers) { struct receiver *current, *tmp; HASH_ITER(hh, receivers, current, tmp) { HASH_DEL(receivers, current); free(current); } } /* *********************************************** */ /* implementation of: https://jeroen.massar.ch/presentations/files/FloCon2010-TopK.pdf * * if (table1.size < max1 || acceptable){ * create new element and add to the table1 * if (table1.size > max2) { * cut table1 back to max1 * merge table 1 to table2 * if(table2.size > max1) * cut table2 back to max1 * } * } * else * update table1 */ static void updateReceivers(struct receiver **receivers, u_int32_t dst_addr, u_int8_t version, u_int32_t num_pkts, struct receiver **topReceivers) { struct receiver *r; u_int32_t size; int a; HASH_FIND_INT(*receivers, (int *)&dst_addr, r); if(r == NULL) { if(((size = HASH_COUNT(*receivers)) < MAX_TABLE_SIZE_1) || ((a = acceptable(num_pkts)) != 0)){ r = (struct receiver *)malloc(sizeof(struct receiver)); if(!r) return; r->addr = dst_addr; r->version = version; r->num_pkts = num_pkts; HASH_ADD_INT(*receivers, addr, r); if((size = HASH_COUNT(*receivers)) > MAX_TABLE_SIZE_2){ HASH_SORT(*receivers, receivers_sort_asc); *receivers = cutBackTo(receivers, size, MAX_TABLE_SIZE_1); mergeTables(receivers, topReceivers); if((size = HASH_COUNT(*topReceivers)) > MAX_TABLE_SIZE_1){ HASH_SORT(*topReceivers, receivers_sort_asc); *topReceivers = cutBackTo(topReceivers, size, MAX_TABLE_SIZE_1); } *receivers = NULL; } } } else r->num_pkts += num_pkts; } /* *********************************************** */ #ifdef HAVE_JSON_C static void saveReceiverStats(json_object **jObj_group, struct receiver **receivers, u_int64_t total_pkt_count) { json_object *jArray_stats = json_object_new_array(); struct receiver *r, *tmp; int i = 0; HASH_ITER(hh, *receivers, r, tmp) { json_object *jObj_stat = json_object_new_object(); char addr_name[48]; if(r->version == IPVERSION) inet_ntop(AF_INET, &(r->addr), addr_name, sizeof(addr_name)); else inet_ntop(AF_INET6, &(r->addr), addr_name, sizeof(addr_name)); json_object_object_add(jObj_stat,"ip.address",json_object_new_string(addr_name)); json_object_object_add(jObj_stat,"packets.number", json_object_new_int(r->num_pkts)); json_object_object_add(jObj_stat,"packets.percent",json_object_new_double(((double)r->num_pkts) / total_pkt_count)); json_object_array_add(jArray_stats, jObj_stat); i++; if(i >= 10) break; } json_object_object_add(*jObj_group, "top.receiver.stats", jArray_stats); } #endif /* *********************************************** */ static void deleteScanners(struct single_flow_info *scanners) { struct single_flow_info *s, *tmp; struct port_flow_info *p, *tmp2; HASH_ITER(hh, scanners, s, tmp) { HASH_ITER(hh, s->ports, p, tmp2) { HASH_DEL(s->ports, p); free(p); } HASH_DEL(scanners, s); free(s); } } /* *********************************************** */ static void deletePortsStats(struct port_stats *stats) { struct port_stats *current_port, *tmp; HASH_ITER(hh, stats, current_port, tmp) { HASH_DEL(stats, current_port); freeIpTree(current_port->addr_tree); free(current_port); } } /* *********************************************** */ /** * @brief Ports stats */ static void port_stats_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) { if((which == ndpi_preorder) || (which == ndpi_leaf)) { /* Avoid walking the same node multiple times */ struct ndpi_flow_info *flow = *(struct ndpi_flow_info **) node; u_int16_t thread_id = *(int *)user_data; u_int16_t sport, dport; char proto[16]; int r; sport = ntohs(flow->src_port), dport = ntohs(flow->dst_port); /* get app level protocol */ if(flow->detected_protocol.master_protocol) ndpi_protocol2name(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol, proto, sizeof(proto)); else strncpy(proto, ndpi_get_proto_name(ndpi_thread_info[thread_id].workflow->ndpi_struct, flow->detected_protocol.app_protocol),sizeof(proto)); if(((r = strcmp(ipProto2Name(flow->protocol), "TCP")) == 0) && (flow->src2dst_packets == 1) && (flow->dst2src_packets == 0)) { updateScanners(&scannerHosts, flow->src_ip, flow->ip_version, dport); } updateReceivers(&receivers, flow->dst_ip, flow->ip_version, flow->src2dst_packets, &topReceivers); updatePortStats(&srcStats, sport, flow->src_ip, flow->ip_version, flow->src2dst_packets, flow->src2dst_bytes, proto); updatePortStats(&dstStats, dport, flow->dst_ip, flow->ip_version, flow->dst2src_packets, flow->dst2src_bytes, proto); } } /* *********************************************** */ /** * @brief Idle Scan Walker */ static void node_idle_scan_walker(const void *node, ndpi_VISIT which, int depth, void *user_data) { struct ndpi_flow_info *flow = *(struct ndpi_flow_info **) node; u_int16_t thread_id = *((u_int16_t *) user_data); if(ndpi_thread_info[thread_id].num_idle_flows == IDLE_SCAN_BUDGET) /* TODO optimise with a budget-based walk */ return; if((which == ndpi_preorder) || (which == ndpi_leaf)) { /* Avoid walking the same node multiple times */ if(flow->last_seen + MAX_IDLE_TIME < ndpi_thread_info[thread_id].workflow->last_time) { /* update stats */ node_proto_guess_walker(node, which, depth, user_data); if((flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) && !undetected_flows_deleted) undetected_flows_deleted = 1; ndpi_free_flow_info_half(flow); ndpi_thread_info[thread_id].workflow->stats.ndpi_flow_count--; /* adding to a queue (we can't delete it from the tree inline ) */ ndpi_thread_info[thread_id].idle_flows[ndpi_thread_info[thread_id].num_idle_flows++] = flow; } } } /** * @brief On Protocol Discover - call node_guess_undetected_protocol() for protocol */ static void on_protocol_discovered(struct ndpi_workflow * workflow, struct ndpi_flow_info * flow, void * udata) { const u_int16_t thread_id = (uintptr_t) udata; if(verbose > 1) { if(enable_protocol_guess) { if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) { flow->detected_protocol.app_protocol = node_guess_undetected_protocol(thread_id, flow), flow->detected_protocol.master_protocol = NDPI_PROTOCOL_UNKNOWN; } } // printFlow(thread_id, flow); } } #if 0 /** * @brief Print debug */ static void debug_printf(u_int32_t protocol, void *id_struct, ndpi_log_level_t log_level, const char *format, ...) { va_list va_ap; #ifndef WIN32 struct tm result; #endif if(log_level <= nDPI_traceLevel) { char buf[8192], out_buf[8192]; char theDate[32]; const char *extra_msg = ""; time_t theTime = time(NULL); va_start (va_ap, format); if(log_level == NDPI_LOG_ERROR) extra_msg = "ERROR: "; else if(log_level == NDPI_LOG_TRACE) extra_msg = "TRACE: "; else extra_msg = "DEBUG: "; memset(buf, 0, sizeof(buf)); strftime(theDate, 32, "%d/%b/%Y %H:%M:%S", localtime_r(&theTime,&result) ); vsnprintf(buf, sizeof(buf)-1, format, va_ap); snprintf(out_buf, sizeof(out_buf), "%s %s%s", theDate, extra_msg, buf); printf("%s", out_buf); fflush(stdout); } va_end(va_ap); } #endif /** * @brief Setup for detection begin */ static void setupDetection(u_int16_t thread_id, pcap_t * pcap_handle) { NDPI_PROTOCOL_BITMASK all; struct ndpi_workflow_prefs prefs; memset(&prefs, 0, sizeof(prefs)); prefs.decode_tunnels = decode_tunnels; prefs.num_roots = NUM_ROOTS; prefs.max_ndpi_flows = MAX_NDPI_FLOWS; prefs.quiet_mode = quiet_mode; memset(&ndpi_thread_info[thread_id], 0, sizeof(ndpi_thread_info[thread_id])); ndpi_thread_info[thread_id].workflow = ndpi_workflow_init(&prefs, pcap_handle); /* Preferences */ ndpi_thread_info[thread_id].workflow->ndpi_struct->http_dont_dissect_response = 0; ndpi_thread_info[thread_id].workflow->ndpi_struct->dns_dissect_response = 0; ndpi_workflow_set_flow_detected_callback(ndpi_thread_info[thread_id].workflow, on_protocol_discovered, (void *)(uintptr_t)thread_id); // enable all protocols NDPI_BITMASK_SET_ALL(all); ndpi_set_protocol_detection_bitmask2(ndpi_thread_info[thread_id].workflow->ndpi_struct, &all); // clear memory for results memset(ndpi_thread_info[thread_id].workflow->stats.protocol_counter, 0, sizeof(ndpi_thread_info[thread_id].workflow->stats.protocol_counter)); memset(ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes, 0, sizeof(ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes)); memset(ndpi_thread_info[thread_id].workflow->stats.protocol_flows, 0, sizeof(ndpi_thread_info[thread_id].workflow->stats.protocol_flows)); if(_protoFilePath != NULL) ndpi_load_protocols_file(ndpi_thread_info[thread_id].workflow->ndpi_struct, _protoFilePath); } /** * @brief End of detection and free flow */ static void terminateDetection(u_int16_t thread_id) { ndpi_workflow_free(ndpi_thread_info[thread_id].workflow); } /** * @brief Traffic stats format */ char* formatTraffic(float numBits, int bits, char *buf) { char unit; if(bits) unit = 'b'; else unit = 'B'; if(numBits < 1024) { snprintf(buf, 32, "%lu %c", (unsigned long)numBits, unit); } else if(numBits < (1024*1024)) { snprintf(buf, 32, "%.2f K%c", (float)(numBits)/1024, unit); } else { float tmpMBits = ((float)numBits)/(1024*1024); if(tmpMBits < 1024) { snprintf(buf, 32, "%.2f M%c", tmpMBits, unit); } else { tmpMBits /= 1024; if(tmpMBits < 1024) { snprintf(buf, 32, "%.2f G%c", tmpMBits, unit); } else { snprintf(buf, 32, "%.2f T%c", (float)(tmpMBits)/1024, unit); } } } return(buf); } /** * @brief Packets stats format */ char* formatPackets(float numPkts, char *buf) { if(numPkts < 1000) { snprintf(buf, 32, "%.2f", numPkts); } else if(numPkts < (1000*1000)) { snprintf(buf, 32, "%.2f K", numPkts/1000); } else { numPkts /= (1000*1000); snprintf(buf, 32, "%.2f M", numPkts); } return(buf); } /** * @brief JSON function init */ #ifdef HAVE_JSON_C static void json_init() { jArray_known_flows = json_object_new_array(); jArray_unknown_flows = json_object_new_array(); jArray_topStats = json_object_new_array(); } static void json_open_stats_file() { if((file_first_time && ((stats_fp = fopen(_statsFilePath,"w")) == NULL)) || (!file_first_time && (stats_fp = fopen(_statsFilePath,"a")) == NULL)) { printf("Error creating/opening file %s\n", _statsFilePath); stats_flag = 0; } else file_first_time = 0; } static void json_close_stats_file() { json_object *jObjFinal = json_object_new_object(); json_object_object_add(jObjFinal,"duration.in.seconds",json_object_new_int(pcap_analysis_duration)); json_object_object_add(jObjFinal,"statistics", jArray_topStats); fprintf(stats_fp,"%s\n",json_object_to_json_string(jObjFinal)); fclose(stats_fp); json_object_put(jObjFinal); } #endif /* *********************************************** */ /** * @brief Bytes stats format */ char* formatBytes(u_int32_t howMuch, char *buf, u_int buf_len) { char unit = 'B'; if(howMuch < 1024) { snprintf(buf, buf_len, "%lu %c", (unsigned long)howMuch, unit); } else if(howMuch < (1024*1024)) { snprintf(buf, buf_len, "%.2f K%c", (float)(howMuch)/1024, unit); } else { float tmpGB = ((float)howMuch)/(1024*1024); if(tmpGB < 1024) { snprintf(buf, buf_len, "%.2f M%c", tmpGB, unit); } else { tmpGB /= 1024; snprintf(buf, buf_len, "%.2f G%c", tmpGB, unit); } } return(buf); } /* *********************************************** */ static int port_stats_sort(void *_a, void *_b) { struct port_stats *a = (struct port_stats*)_a; struct port_stats *b = (struct port_stats*)_b; if(b->num_pkts == 0 && a->num_pkts == 0) return(b->num_flows - a->num_flows); return(b->num_pkts - a->num_pkts); } /* *********************************************** */ #ifdef HAVE_JSON_C static int scanners_sort(void *_a, void *_b) { struct single_flow_info *a = (struct single_flow_info *)_a; struct single_flow_info *b = (struct single_flow_info *)_b; return(b->tot_flows - a->tot_flows); } /* *********************************************** */ static int scanners_port_sort(void *_a, void *_b) { struct port_flow_info *a = (struct port_flow_info *)_a; struct port_flow_info *b = (struct port_flow_info *)_b; return(b->num_flows - a->num_flows); } #endif /* *********************************************** */ static int info_pair_cmp (const void *_a, const void *_b) { struct info_pair *a = (struct info_pair *)_a; struct info_pair *b = (struct info_pair *)_b; return b->count - a->count; } /* *********************************************** */ #ifdef HAVE_JSON_C static int top_stats_sort(void *_a, void *_b) { struct port_stats *a = (struct port_stats*)_a; struct port_stats *b = (struct port_stats*)_b; return(b->num_addr - a->num_addr); } /* *********************************************** */ /** * @brief Get port based top statistics */ static int getTopStats(struct port_stats *stats) { struct port_stats *sp, *tmp; struct info_pair inf; u_int64_t total_ip_addrs = 0; HASH_ITER(hh, stats, sp, tmp) { qsort(sp->top_ip_addrs, MAX_NUM_IP_ADDRESS, sizeof(struct info_pair), info_pair_cmp); inf = sp->top_ip_addrs[0]; if(((inf.count * 100.0)/sp->cumulative_addr) > AGGRESSIVE_PERCENT) { sp->hasTopHost = 1; sp->top_host = inf.addr; sp->version = inf.version; strncpy(sp->proto, inf.proto, sizeof(sp->proto)); } else sp->hasTopHost = 0; total_ip_addrs += sp->num_addr; } return total_ip_addrs; } /* *********************************************** */ static void saveScannerStats(json_object **jObj_group, struct single_flow_info **scanners) { struct single_flow_info *s, *tmp; struct port_flow_info *p, *tmp2; char addr_name[48]; int i = 0, j = 0; json_object *jArray_stats = json_object_new_array(); HASH_SORT(*scanners, scanners_sort); // FIX HASH_ITER(hh, *scanners, s, tmp) { json_object *jObj_stat = json_object_new_object(); json_object *jArray_ports = json_object_new_array(); if(s->version == IPVERSION) inet_ntop(AF_INET, &(s->saddr), addr_name, sizeof(addr_name)); else inet_ntop(AF_INET6, &(s->saddr), addr_name, sizeof(addr_name)); json_object_object_add(jObj_stat,"ip.address",json_object_new_string(addr_name)); json_object_object_add(jObj_stat,"total.flows.number",json_object_new_int(s->tot_flows)); HASH_SORT(s->ports, scanners_port_sort); HASH_ITER(hh, s->ports, p, tmp2) { json_object *jObj_port = json_object_new_object(); json_object_object_add(jObj_port,"port",json_object_new_int(p->port)); json_object_object_add(jObj_port,"flows.number",json_object_new_int(p->num_flows)); json_object_array_add(jArray_ports, jObj_port); j++; if(j >= 10) break; } json_object_object_add(jObj_stat,"top.dst.ports",jArray_ports); json_object_array_add(jArray_stats, jObj_stat); j = 0; i++; if(i >= 10) break; } json_object_object_add(*jObj_group, "top.scanner.stats", jArray_stats); } #endif /* *********************************************** */ #ifdef HAVE_JSON_C /* * @brief Save Top Stats in json format */ static void saveTopStats(json_object **jObj_group, struct port_stats **stats, u_int8_t direction, u_int64_t total_flow_count, u_int64_t total_ip_addr) { struct port_stats *s, *tmp; char addr_name[48]; int i = 0; json_object *jArray_stats = json_object_new_array(); HASH_ITER(hh, *stats, s, tmp) { if((s->hasTopHost)) { json_object *jObj_stat = json_object_new_object(); json_object_object_add(jObj_stat,"port",json_object_new_int(s->port)); json_object_object_add(jObj_stat,"packets.number",json_object_new_int(s->num_pkts)); json_object_object_add(jObj_stat,"flows.number",json_object_new_int(s->num_flows)); json_object_object_add(jObj_stat,"flows.percent",json_object_new_double((s->num_flows*100.0)/total_flow_count)); if(s->num_pkts) json_object_object_add(jObj_stat,"flows/packets", json_object_new_double(((double)s->num_flows)/s->num_pkts)); else json_object_object_add(jObj_stat,"flows.num_packets",json_object_new_double(0.0)); if(s->version == IPVERSION) { inet_ntop(AF_INET, &(s->top_host), addr_name, sizeof(addr_name)); } else { inet_ntop(AF_INET6, &(s->top_host), addr_name, sizeof(addr_name)); } json_object_object_add(jObj_stat,"aggressive.host",json_object_new_string(addr_name)); json_object_object_add(jObj_stat,"host.app.protocol",json_object_new_string(s->proto)); json_object_array_add(jArray_stats, jObj_stat); i++; if(i >= 10) break; } } json_object_object_add(*jObj_group, (direction == DIR_SRC) ? "top.src.pkts.stats" : "top.dst.pkts.stats", jArray_stats); jArray_stats = json_object_new_array(); i=0; /*sort top stats by ip addr count*/ HASH_SORT(*stats, top_stats_sort); HASH_ITER(hh, *stats, s, tmp) { json_object *jObj_stat = json_object_new_object(); json_object_object_add(jObj_stat,"port",json_object_new_int(s->port)); json_object_object_add(jObj_stat,"host.number",json_object_new_int64(s->num_addr)); json_object_object_add(jObj_stat,"host.percent",json_object_new_double((s->num_addr*100.0)/total_ip_addr)); json_object_object_add(jObj_stat,"flows.number",json_object_new_int(s->num_flows)); json_object_array_add(jArray_stats,jObj_stat); i++; if(i >= 10) break; } json_object_object_add(*jObj_group, (direction == DIR_SRC) ? "top.src.host.stats" : "top.dst.host.stats", jArray_stats); } #endif /* *********************************************** */ void printPortStats(struct port_stats *stats) { struct port_stats *s, *tmp; char addr_name[48]; int i = 0, j = 0; HASH_ITER(hh, stats, s, tmp) { i++; printf("\t%2d\tPort %5u\t[%u IP address(es)/%u flows/%u pkts/%u bytes]\n\t\tTop IP Stats:\n", i, s->port, s->num_addr, s->num_flows, s->num_pkts, s->num_bytes); qsort(&s->top_ip_addrs[0], MAX_NUM_IP_ADDRESS, sizeof(struct info_pair), info_pair_cmp); for(j=0; jtop_ip_addrs[j].count != 0) { if(s->top_ip_addrs[j].version == IPVERSION) { inet_ntop(AF_INET, &(s->top_ip_addrs[j].addr), addr_name, sizeof(addr_name)); } else { inet_ntop(AF_INET6, &(s->top_ip_addrs[j].addr), addr_name, sizeof(addr_name)); } printf("\t\t%-36s ~ %.2f%%\n", addr_name, ((s->top_ip_addrs[j].count) * 100.0) / s->cumulative_addr); } } printf("\n"); if(i >= 10) break; } } /* *********************************************** */ /** * @brief Print result */ static void printResults(u_int64_t tot_usec) { u_int32_t i; u_int64_t total_flow_bytes = 0; u_int32_t avg_pkt_size = 0; struct ndpi_stats cumulative_stats; int thread_id; char buf[32]; #ifdef HAVE_JSON_C FILE *json_fp = NULL; json_object *jObj_main = NULL, *jObj_trafficStats, *jArray_detProto = NULL, *jObj; #endif long long unsigned int breed_stats[NUM_BREEDS] = { 0 }; memset(&cumulative_stats, 0, sizeof(cumulative_stats)); for(thread_id = 0; thread_id < num_threads; thread_id++) { if((ndpi_thread_info[thread_id].workflow->stats.total_wire_bytes == 0) && (ndpi_thread_info[thread_id].workflow->stats.raw_packet_count == 0)) continue; for(i=0; indpi_flows_root[i], node_proto_guess_walker, &thread_id); if(verbose == 3 || stats_flag) ndpi_twalk(ndpi_thread_info[thread_id].workflow->ndpi_flows_root[i], port_stats_walker, &thread_id); } /* Stats aggregation */ cumulative_stats.guessed_flow_protocols += ndpi_thread_info[thread_id].workflow->stats.guessed_flow_protocols; cumulative_stats.raw_packet_count += ndpi_thread_info[thread_id].workflow->stats.raw_packet_count; cumulative_stats.ip_packet_count += ndpi_thread_info[thread_id].workflow->stats.ip_packet_count; cumulative_stats.total_wire_bytes += ndpi_thread_info[thread_id].workflow->stats.total_wire_bytes; cumulative_stats.total_ip_bytes += ndpi_thread_info[thread_id].workflow->stats.total_ip_bytes; cumulative_stats.total_discarded_bytes += ndpi_thread_info[thread_id].workflow->stats.total_discarded_bytes; for(i = 0; i < ndpi_get_num_supported_protocols(ndpi_thread_info[0].workflow->ndpi_struct); i++) { cumulative_stats.protocol_counter[i] += ndpi_thread_info[thread_id].workflow->stats.protocol_counter[i]; cumulative_stats.protocol_counter_bytes[i] += ndpi_thread_info[thread_id].workflow->stats.protocol_counter_bytes[i]; cumulative_stats.protocol_flows[i] += ndpi_thread_info[thread_id].workflow->stats.protocol_flows[i]; } cumulative_stats.ndpi_flow_count += ndpi_thread_info[thread_id].workflow->stats.ndpi_flow_count; cumulative_stats.tcp_count += ndpi_thread_info[thread_id].workflow->stats.tcp_count; cumulative_stats.udp_count += ndpi_thread_info[thread_id].workflow->stats.udp_count; cumulative_stats.mpls_count += ndpi_thread_info[thread_id].workflow->stats.mpls_count; cumulative_stats.pppoe_count += ndpi_thread_info[thread_id].workflow->stats.pppoe_count; cumulative_stats.vlan_count += ndpi_thread_info[thread_id].workflow->stats.vlan_count; cumulative_stats.fragmented_count += ndpi_thread_info[thread_id].workflow->stats.fragmented_count; for(i = 0; i < sizeof(cumulative_stats.packet_len)/sizeof(cumulative_stats.packet_len[0]); i++) cumulative_stats.packet_len[i] += ndpi_thread_info[thread_id].workflow->stats.packet_len[i]; cumulative_stats.max_packet_len += ndpi_thread_info[thread_id].workflow->stats.max_packet_len; } if(cumulative_stats.total_wire_bytes == 0) goto free_stats; if(!quiet_mode) { printf("\nnDPI Memory statistics:\n"); printf("\tnDPI Memory (once): %-13s\n", formatBytes(sizeof(struct ndpi_detection_module_struct), buf, sizeof(buf))); printf("\tFlow Memory (per flow): %-13s\n", formatBytes(sizeof(struct ndpi_flow_struct), buf, sizeof(buf))); printf("\tActual Memory: %-13s\n", formatBytes(current_ndpi_memory, buf, sizeof(buf))); printf("\tPeak Memory: %-13s\n", formatBytes(max_ndpi_memory, buf, sizeof(buf))); if(!json_flag) { printf("\nTraffic statistics:\n"); printf("\tEthernet bytes: %-13llu (includes ethernet CRC/IFC/trailer)\n", (long long unsigned int)cumulative_stats.total_wire_bytes); printf("\tDiscarded bytes: %-13llu\n", (long long unsigned int)cumulative_stats.total_discarded_bytes); printf("\tIP packets: %-13llu of %llu packets total\n", (long long unsigned int)cumulative_stats.ip_packet_count, (long long unsigned int)cumulative_stats.raw_packet_count); /* In order to prevent Floating point exception in case of no traffic*/ if(cumulative_stats.total_ip_bytes && cumulative_stats.raw_packet_count) avg_pkt_size = (unsigned int)(cumulative_stats.total_ip_bytes/cumulative_stats.raw_packet_count); printf("\tIP bytes: %-13llu (avg pkt size %u bytes)\n", (long long unsigned int)cumulative_stats.total_ip_bytes,avg_pkt_size); printf("\tUnique flows: %-13u\n", cumulative_stats.ndpi_flow_count); printf("\tTCP Packets: %-13lu\n", (unsigned long)cumulative_stats.tcp_count); printf("\tUDP Packets: %-13lu\n", (unsigned long)cumulative_stats.udp_count); printf("\tVLAN Packets: %-13lu\n", (unsigned long)cumulative_stats.vlan_count); printf("\tMPLS Packets: %-13lu\n", (unsigned long)cumulative_stats.mpls_count); printf("\tPPPoE Packets: %-13lu\n", (unsigned long)cumulative_stats.pppoe_count); printf("\tFragmented Packets: %-13lu\n", (unsigned long)cumulative_stats.fragmented_count); printf("\tMax Packet size: %-13u\n", cumulative_stats.max_packet_len); printf("\tPacket Len < 64: %-13lu\n", (unsigned long)cumulative_stats.packet_len[0]); printf("\tPacket Len 64-128: %-13lu\n", (unsigned long)cumulative_stats.packet_len[1]); printf("\tPacket Len 128-256: %-13lu\n", (unsigned long)cumulative_stats.packet_len[2]); printf("\tPacket Len 256-1024: %-13lu\n", (unsigned long)cumulative_stats.packet_len[3]); printf("\tPacket Len 1024-1500: %-13lu\n", (unsigned long)cumulative_stats.packet_len[4]); printf("\tPacket Len > 1500: %-13lu\n", (unsigned long)cumulative_stats.packet_len[5]); if(tot_usec > 0) { char buf[32], buf1[32], when[64]; float t = (float)(cumulative_stats.ip_packet_count*1000000)/(float)tot_usec; float b = (float)(cumulative_stats.total_wire_bytes * 8 *1000000)/(float)tot_usec; float traffic_duration; if(live_capture) traffic_duration = tot_usec; else traffic_duration = (pcap_end.tv_sec*1000000 + pcap_end.tv_usec) - (pcap_start.tv_sec*1000000 + pcap_start.tv_usec); printf("\tnDPI throughput: %s pps / %s/sec\n", formatPackets(t, buf), formatTraffic(b, 1, buf1)); t = (float)(cumulative_stats.ip_packet_count*1000000)/(float)traffic_duration; b = (float)(cumulative_stats.total_wire_bytes * 8 *1000000)/(float)traffic_duration; strftime(when, sizeof(when), "%d/%b/%Y %H:%M:%S", localtime(&pcap_start.tv_sec)); printf("\tAnalysis begin: %s\n", when); strftime(when, sizeof(when), "%d/%b/%Y %H:%M:%S", localtime(&pcap_end.tv_sec)); printf("\tAnalysis end: %s\n", when); printf("\tTraffic throughput: %s pps / %s/sec\n", formatPackets(t, buf), formatTraffic(b, 1, buf1)); printf("\tTraffic duration: %.3f sec\n", traffic_duration/1000000); } if(enable_protocol_guess) printf("\tGuessed flow protos: %-13u\n", cumulative_stats.guessed_flow_protocols); } } if(json_flag) { #ifdef HAVE_JSON_C if((json_fp = fopen(_jsonFilePath,"w")) == NULL) { printf("Error creating .json file %s\n", _jsonFilePath); json_flag = 0; } else { jObj_main = json_object_new_object(); jObj_trafficStats = json_object_new_object(); jArray_detProto = json_object_new_array(); json_object_object_add(jObj_trafficStats,"ethernet.bytes",json_object_new_int64(cumulative_stats.total_wire_bytes)); json_object_object_add(jObj_trafficStats,"discarded.bytes",json_object_new_int64(cumulative_stats.total_discarded_bytes)); json_object_object_add(jObj_trafficStats,"ip.packets",json_object_new_int64(cumulative_stats.ip_packet_count)); json_object_object_add(jObj_trafficStats,"total.packets",json_object_new_int64(cumulative_stats.raw_packet_count)); json_object_object_add(jObj_trafficStats,"ip.bytes",json_object_new_int64(cumulative_stats.total_ip_bytes)); json_object_object_add(jObj_trafficStats,"avg.pkt.size",json_object_new_int(cumulative_stats.total_ip_bytes/cumulative_stats.raw_packet_count)); json_object_object_add(jObj_trafficStats,"unique.flows",json_object_new_int(cumulative_stats.ndpi_flow_count)); json_object_object_add(jObj_trafficStats,"tcp.pkts",json_object_new_int64(cumulative_stats.tcp_count)); json_object_object_add(jObj_trafficStats,"udp.pkts",json_object_new_int64(cumulative_stats.udp_count)); json_object_object_add(jObj_trafficStats,"vlan.pkts",json_object_new_int64(cumulative_stats.vlan_count)); json_object_object_add(jObj_trafficStats,"mpls.pkts",json_object_new_int64(cumulative_stats.mpls_count)); json_object_object_add(jObj_trafficStats,"pppoe.pkts",json_object_new_int64(cumulative_stats.pppoe_count)); json_object_object_add(jObj_trafficStats,"fragmented.pkts",json_object_new_int64(cumulative_stats.fragmented_count)); json_object_object_add(jObj_trafficStats,"max.pkt.size",json_object_new_int(cumulative_stats.max_packet_len)); json_object_object_add(jObj_trafficStats,"pkt.len_min64",json_object_new_int64(cumulative_stats.packet_len[0])); json_object_object_add(jObj_trafficStats,"pkt.len_64_128",json_object_new_int64(cumulative_stats.packet_len[1])); json_object_object_add(jObj_trafficStats,"pkt.len_128_256",json_object_new_int64(cumulative_stats.packet_len[2])); json_object_object_add(jObj_trafficStats,"pkt.len_256_1024",json_object_new_int64(cumulative_stats.packet_len[3])); json_object_object_add(jObj_trafficStats,"pkt.len_1024_1500",json_object_new_int64(cumulative_stats.packet_len[4])); json_object_object_add(jObj_trafficStats,"pkt.len_grt1500",json_object_new_int64(cumulative_stats.packet_len[5])); json_object_object_add(jObj_trafficStats,"guessed.flow.protos",json_object_new_int(cumulative_stats.guessed_flow_protocols)); json_object_object_add(jObj_main,"traffic.statistics",jObj_trafficStats); } #endif } if((!json_flag) && (!quiet_mode)) printf("\n\nDetected protocols:\n"); for(i = 0; i <= ndpi_get_num_supported_protocols(ndpi_thread_info[0].workflow->ndpi_struct); i++) { ndpi_protocol_breed_t breed = ndpi_get_proto_breed(ndpi_thread_info[0].workflow->ndpi_struct, i); if(cumulative_stats.protocol_counter[i] > 0) { breed_stats[breed] += (long long unsigned int)cumulative_stats.protocol_counter_bytes[i]; if(results_file) fprintf(results_file, "%s\t%llu\t%llu\t%u\n", ndpi_get_proto_name(ndpi_thread_info[0].workflow->ndpi_struct, i), (long long unsigned int)cumulative_stats.protocol_counter[i], (long long unsigned int)cumulative_stats.protocol_counter_bytes[i], cumulative_stats.protocol_flows[i]); if((!json_flag) && (!quiet_mode)) { printf("\t%-20s packets: %-13llu bytes: %-13llu " "flows: %-13u\n", ndpi_get_proto_name(ndpi_thread_info[0].workflow->ndpi_struct, i), (long long unsigned int)cumulative_stats.protocol_counter[i], (long long unsigned int)cumulative_stats.protocol_counter_bytes[i], cumulative_stats.protocol_flows[i]); } else { #ifdef HAVE_JSON_C if(json_fp) { jObj = json_object_new_object(); json_object_object_add(jObj,"name",json_object_new_string(ndpi_get_proto_name(ndpi_thread_info[0].workflow->ndpi_struct, i))); json_object_object_add(jObj,"breed",json_object_new_string(ndpi_get_proto_breed_name(ndpi_thread_info[0].workflow->ndpi_struct, breed))); json_object_object_add(jObj,"packets",json_object_new_int64(cumulative_stats.protocol_counter[i])); json_object_object_add(jObj,"bytes",json_object_new_int64(cumulative_stats.protocol_counter_bytes[i])); json_object_object_add(jObj,"flows",json_object_new_int(cumulative_stats.protocol_flows[i])); json_object_array_add(jArray_detProto,jObj); } #endif } total_flow_bytes += cumulative_stats.protocol_counter_bytes[i]; } } if((!json_flag) && (!quiet_mode)) { printf("\n\nProtocol statistics:\n"); for(i=0; i < NUM_BREEDS; i++) { if(breed_stats[i] > 0) { printf("\t%-20s %13llu bytes\n", ndpi_get_proto_breed_name(ndpi_thread_info[0].workflow->ndpi_struct, i), breed_stats[i]); } } } // printf("\n\nTotal Flow Traffic: %llu (diff: %llu)\n", total_flow_bytes, cumulative_stats.total_ip_bytes-total_flow_bytes); if((verbose == 1) || (verbose == 2)) { FILE *out = results_file ? results_file : stdout; u_int32_t total_flows = 0; for(thread_id = 0; thread_id < num_threads; thread_id++) total_flows += ndpi_thread_info[thread_id].workflow->num_allocated_flows; if((all_flows = (struct flow_info*)malloc(sizeof(struct flow_info)*total_flows)) == NULL) { printf("Fatal error: not enough memory\n"); exit(-1); } if(!json_flag) fprintf(out, "\n"); num_flows = 0; for(thread_id = 0; thread_id < num_threads; thread_id++) { for(i=0; indpi_flows_root[i], node_print_known_proto_walker, &thread_id); } qsort(all_flows, num_flows, sizeof(struct flow_info), cmpFlows); for(i=0; istats.protocol_counter[0 /* 0 = Unknown */] > 0) { if(!json_flag) { FILE *out = results_file ? results_file : stdout; fprintf(out, "\n\nUndetected flows:%s\n", undetected_flows_deleted ? " (expired flows are not listed below)" : ""); } if(json_flag) json_flag = 2; break; } } num_flows = 0; for(thread_id = 0; thread_id < num_threads; thread_id++) { if(ndpi_thread_info[thread_id].workflow->stats.protocol_counter[0] > 0) { for(i=0; indpi_flows_root[i], node_print_unknown_proto_walker, &thread_id); } } qsort(all_flows, num_flows, sizeof(struct flow_info), cmpFlows); for(i=0; ipcap_handle != NULL) { pcap_breakloop(ndpi_thread_info[thread_id].workflow->pcap_handle); } } /** * @brief Sigproc is executed for each packet in the pcap file */ void sigproc(int sig) { static int called = 0; int thread_id; if(called) return; else called = 1; shutdown_app = 1; for(thread_id=0; thread_id 0) { if((!json_flag) && (!quiet_mode)) printf("Capturing traffic up to %u seconds\n", (unsigned int)capture_for); #ifndef WIN32 alarm(capture_for); signal(SIGALRM, sigproc); #endif } return pcap_handle; } /** * @brief Check pcap packet */ static void pcap_process_packet(u_char *args, const struct pcap_pkthdr *header, const u_char *packet) { struct ndpi_proto p; u_int16_t thread_id = *((u_int16_t*)args); /* allocate an exact size buffer to check overflows */ uint8_t *packet_checked = malloc(header->caplen); memcpy(packet_checked, packet, header->caplen); p = ndpi_workflow_process_packet(ndpi_thread_info[thread_id].workflow, header, packet_checked); if((capture_until != 0) && (header->ts.tv_sec >= capture_until)) { if(ndpi_thread_info[thread_id].workflow->pcap_handle != NULL) pcap_breakloop(ndpi_thread_info[thread_id].workflow->pcap_handle); return; } if(!pcap_start.tv_sec) pcap_start.tv_sec = header->ts.tv_sec, pcap_start.tv_usec = header->ts.tv_usec; pcap_end.tv_sec = header->ts.tv_sec, pcap_end.tv_usec = header->ts.tv_usec; /* Idle flows cleanup */ if(live_capture) { if(ndpi_thread_info[thread_id].last_idle_scan_time + IDLE_SCAN_PERIOD < ndpi_thread_info[thread_id].workflow->last_time) { /* scan for idle flows */ ndpi_twalk(ndpi_thread_info[thread_id].workflow->ndpi_flows_root[ndpi_thread_info[thread_id].idle_scan_idx], node_idle_scan_walker, &thread_id); /* remove idle flows (unfortunately we cannot do this inline) */ while (ndpi_thread_info[thread_id].num_idle_flows > 0) { /* search and delete the idle flow from the "ndpi_flow_root" (see struct reader thread) - here flows are the node of a b-tree */ ndpi_tdelete(ndpi_thread_info[thread_id].idle_flows[--ndpi_thread_info[thread_id].num_idle_flows], &ndpi_thread_info[thread_id].workflow->ndpi_flows_root[ndpi_thread_info[thread_id].idle_scan_idx], ndpi_workflow_node_cmp); /* free the memory associated to idle flow in "idle_flows" - (see struct reader thread)*/ ndpi_free_flow_info_half(ndpi_thread_info[thread_id].idle_flows[ndpi_thread_info[thread_id].num_idle_flows]); ndpi_free(ndpi_thread_info[thread_id].idle_flows[ndpi_thread_info[thread_id].num_idle_flows]); } if(++ndpi_thread_info[thread_id].idle_scan_idx == ndpi_thread_info[thread_id].workflow->prefs.num_roots) ndpi_thread_info[thread_id].idle_scan_idx = 0; ndpi_thread_info[thread_id].last_idle_scan_time = ndpi_thread_info[thread_id].workflow->last_time; } } #ifdef DEBUG_TRACE if(trace) fprintf(trace, "Found %u bytes packet %u.%u\n", header->caplen, p.app_protocol, p.master_protocol); #endif if(extcap_dumper && ((extcap_packet_filter == (u_int16_t)-1) || (p.app_protocol == extcap_packet_filter) || (p.master_protocol == extcap_packet_filter) ) ) { struct pcap_pkthdr h; uint32_t *crc, delta = sizeof(struct ndpi_packet_trailer) + 4 /* ethernet trailer */; struct ndpi_packet_trailer *trailer; memcpy(&h, header, sizeof(h)); if(h.caplen > (sizeof(extcap_buf)-sizeof(struct ndpi_packet_trailer) - 4)) { printf("INTERNAL ERROR: caplen=%u\n", h.caplen); h.caplen = sizeof(extcap_buf)-sizeof(struct ndpi_packet_trailer) - 4; } trailer = (struct ndpi_packet_trailer*)&extcap_buf[h.caplen]; memcpy(extcap_buf, packet, h.caplen); memset(trailer, 0, sizeof(struct ndpi_packet_trailer)); trailer->magic = htonl(0x19680924); trailer->master_protocol = htons(p.master_protocol), trailer->app_protocol = htons(p.app_protocol); ndpi_protocol2name(ndpi_thread_info[thread_id].workflow->ndpi_struct, p, trailer->name, sizeof(trailer->name)); crc = (uint32_t*)&extcap_buf[h.caplen+sizeof(struct ndpi_packet_trailer)]; *crc = ethernet_crc32((const void*)extcap_buf, h.caplen+sizeof(struct ndpi_packet_trailer)); h.caplen += delta; h.len += delta; #ifdef DEBUG_TRACE if(trace) fprintf(trace, "Dumping %u bytes packet\n", h.caplen); #endif pcap_dump((u_char*)extcap_dumper, &h, (const u_char *)extcap_buf); pcap_dump_flush(extcap_dumper); } /* check for buffer changes */ if(memcmp(packet, packet_checked, header->caplen) != 0) printf("INTERNAL ERROR: ingress packet was modified by nDPI: this should not happen [thread_id=%u, packetId=%lu, caplen=%u]\n", thread_id, (unsigned long)ndpi_thread_info[thread_id].workflow->stats.raw_packet_count, header->caplen); free(packet_checked); if((pcap_end.tv_sec-pcap_start.tv_sec) > pcap_analysis_duration) { int i; u_int64_t tot_usec; gettimeofday(&end, NULL); tot_usec = end.tv_sec*1000000 + end.tv_usec - (begin.tv_sec*1000000 + begin.tv_usec); printResults(tot_usec); for(i=0; iprefs.num_roots; i++) { ndpi_tdestroy(ndpi_thread_info[thread_id].workflow->ndpi_flows_root[i], ndpi_flow_info_freer); ndpi_thread_info[thread_id].workflow->ndpi_flows_root[i] = NULL; memset(&ndpi_thread_info[thread_id].workflow->stats, 0, sizeof(struct ndpi_stats)); } printf("\n-------------------------------------------\n\n"); memcpy(&begin, &end, sizeof(begin)); memcpy(&pcap_start, &pcap_end, sizeof(pcap_start)); } } /** * @brief Call pcap_loop() to process packets from a live capture or savefile */ static void runPcapLoop(u_int16_t thread_id) { if((!shutdown_app) && (ndpi_thread_info[thread_id].workflow->pcap_handle != NULL)) pcap_loop(ndpi_thread_info[thread_id].workflow->pcap_handle, -1, &pcap_process_packet, (u_char*)&thread_id); } /** * @brief Process a running thread */ void * processing_thread(void *_thread_id) { long thread_id = (long) _thread_id; char pcap_error_buffer[PCAP_ERRBUF_SIZE]; #if defined(linux) && defined(HAVE_PTHREAD_SETAFFINITY_NP) if(core_affinity[thread_id] >= 0) { cpu_set_t cpuset; CPU_ZERO(&cpuset); CPU_SET(core_affinity[thread_id], &cpuset); if(pthread_setaffinity_np(pthread_self(), sizeof(cpu_set_t), &cpuset) != 0) fprintf(stderr, "Error while binding thread %ld to core %d\n", thread_id, core_affinity[thread_id]); else { if((!json_flag) && (!quiet_mode)) printf("Running thread %ld on core %d...\n", thread_id, core_affinity[thread_id]); } } else #endif if((!json_flag) && (!quiet_mode)) printf("Running thread %ld...\n", thread_id); pcap_loop: runPcapLoop(thread_id); if(playlist_fp[thread_id] != NULL) { /* playlist: read next file */ char filename[256]; if(getNextPcapFileFromPlaylist(thread_id, filename, sizeof(filename)) == 0 && (ndpi_thread_info[thread_id].workflow->pcap_handle = pcap_open_offline(filename, pcap_error_buffer)) != NULL) { configurePcapHandle(ndpi_thread_info[thread_id].workflow->pcap_handle); goto pcap_loop; } } return NULL; } /** * @brief Begin, process, end detection process */ void test_lib() { struct timeval end; u_int64_t tot_usec; long thread_id; #ifdef HAVE_JSON_C json_init(); if(stats_flag) json_open_stats_file(); #endif #ifdef DEBUG_TRACE if(trace) fprintf(trace, "Num threads: %d\n", num_threads); #endif for(thread_id = 0; thread_id < num_threads; thread_id++) { pcap_t *cap; #ifdef DEBUG_TRACE if(trace) fprintf(trace, "Opening %s\n", (const u_char*)_pcap_file[thread_id]); #endif cap = openPcapFileOrDevice(thread_id, (const u_char*)_pcap_file[thread_id]); setupDetection(thread_id, cap); } gettimeofday(&begin, NULL); int status; void * thd_res; /* Running processing threads */ for(thread_id = 0; thread_id < num_threads; thread_id++) { status = pthread_create(&ndpi_thread_info[thread_id].pthread, NULL, processing_thread, (void *) thread_id); /* check pthreade_create return value */ if(status != 0) { fprintf(stderr, "error on create %ld thread\n", thread_id); exit(-1); } } /* Waiting for completion */ for(thread_id = 0; thread_id < num_threads; thread_id++) { status = pthread_join(ndpi_thread_info[thread_id].pthread, &thd_res); /* check pthreade_join return value */ if(status != 0) { fprintf(stderr, "error on join %ld thread\n", thread_id); exit(-1); } if(thd_res != NULL) { fprintf(stderr, "error on returned value of %ld joined thread\n", thread_id); exit(-1); } } gettimeofday(&end, NULL); tot_usec = end.tv_sec*1000000 + end.tv_usec - (begin.tv_sec*1000000 + begin.tv_usec); /* Printing cumulative results */ printResults(tot_usec); if(stats_flag) { #ifdef HAVE_JSON_C json_close_stats_file(); #endif } for(thread_id = 0; thread_id < num_threads; thread_id++) { if(ndpi_thread_info[thread_id].workflow->pcap_handle != NULL) pcap_close(ndpi_thread_info[thread_id].workflow->pcap_handle); terminateDetection(thread_id); } } void automataUnitTest() { void *automa; assert(automa = ndpi_init_automa()); assert(ndpi_add_string_to_automa(automa, "hello") == 0); assert(ndpi_add_string_to_automa(automa, "world") == 0); ndpi_finalize_automa(automa); assert(ndpi_match_string(automa, "This is the wonderful world of nDPI") == 0); ndpi_free_automa(automa); } /* *********************************************** */ /** * @brief Produce bpf filter to filter ports and hosts * in order to remove a peak in terms of number of packets * sent by source hosts. */ #ifdef HAVE_JSON_C void bpf_filter_pkt_peak_filter(json_object **jObj_bpfFilter, int port_array[], int p_size, const char *src_host_array[16], int sh_size, const char *dst_host_array[16], int dh_size) { char filter[2048]; int produced = 0; int i = 0; if(port_array[0] != INIT_VAL) { int l; strcpy(filter, "not (src port "); while(i < p_size && port_array[i] != INIT_VAL) { l = strlen(filter); if(i+1 == p_size || port_array[i+1] == INIT_VAL) snprintf(&filter[l], sizeof(filter)-l, "%d", port_array[i]); else snprintf(&filter[l], sizeof(filter)-l, "%d or ", port_array[i]); i++; } l = strlen(filter); snprintf(&filter[l], sizeof(filter)-l, "%s", ")"); produced = 1; } if(src_host_array[0] != NULL) { int l; if(port_array[0] != INIT_VAL) strncat(filter, " and not (src ", sizeof(" and not (src ")); else strcpy(filter, "not (src "); i=0; while(i < sh_size && src_host_array[i] != NULL) { l = strlen(filter); if(i+1 == sh_size || src_host_array[i+1] == NULL) snprintf(&filter[l], sizeof(filter)-l, "%s", src_host_array[i]); else snprintf(&filter[l], sizeof(filter)-l, "%s or ", src_host_array[i]); i++; } l = strlen(filter); snprintf(&filter[l], sizeof(filter)-l, "%s", ")"); produced = 1; } if(dst_host_array[0] != NULL) { int l; if(port_array[0] != INIT_VAL || src_host_array[0] != NULL) strncat(filter, " and not (dst ", sizeof(" and not (dst ")); else strcpy(filter, "not (dst "); i=0; while(i < dh_size && dst_host_array[i] != NULL) { l = strlen(filter); if(i+1 == dh_size || dst_host_array[i+1] == NULL) snprintf(&filter[l], sizeof(filter)-l, "%s", dst_host_array[i]); else snprintf(&filter[l], sizeof(filter)-l, "%s or ", dst_host_array[i]); i++; } l = strlen(filter); snprintf(&filter[l], sizeof(filter)-l, "%s", ")"); produced = 1; } if(produced) json_object_object_add(*jObj_bpfFilter, "pkt.peak.filter", json_object_new_string(filter)); else json_object_object_add(*jObj_bpfFilter, "pkt.peak.filter", json_object_new_string("")); } #endif /* *********************************************** */ /** * @brief Produce bpf filter to filter ports and hosts * in order to remove a peak in terms of number of source * addresses. */ #ifdef HAVE_JSON_C void bpf_filter_host_peak_filter(json_object **jObj_bpfFilter, const char *host_array[16], int h_size) { char filter[2048]; int produced = 0; int i = 0; if(host_array[0] != NULL) { int l; strcpy(filter, "not (dst "); while(i < h_size && host_array[i] != NULL) { l = strlen(filter); if(i+1 == h_size || host_array[i+1] == NULL) snprintf(&filter[l], sizeof(filter)-l, "%s", host_array[i]); else snprintf(&filter[l], sizeof(filter)-l, "%s or ", host_array[i]); i++; } l = strlen(filter); snprintf(&filter[l], sizeof(filter)-l, "%s", ")"); produced = 1; } if(produced) json_object_object_add(*jObj_bpfFilter, "host.peak.filter", json_object_new_string(filter)); else json_object_object_add(*jObj_bpfFilter, "host.peak.filter", json_object_new_string("")); } #endif /* *********************************************** */ /** * @brief Initialize port array */ void bpf_filter_port_array_init(int array[], int size) { int i; for(i=0; i FLOWS_PACKETS_THRESHOLD) && (flows_percent >= FLOWS_PERCENT_THRESHOLD) && packets_number >= threshold) { if((res = json_object_object_get_ex(src_pkts_stat, "port", &jObj_port)) == 0) { fprintf(stderr, "ERROR: can't get \"port\", use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } int port = json_object_get_int(jObj_port); bpf_filter_port_array_add(srcPortArray, size, port); } } } #endif /* *********************************************** */ #ifdef HAVE_JSON_C void getReceiverHosts(struct json_object *jObj_stat, const char *dstHostArray[16], int size) { int j; for(j=0; j PKTS_PERCENT_THRESHOLD) { if((res = json_object_object_get_ex(scanner_stat, "ip.address", &jObj_host_address)) == 0) { fprintf(stderr, "ERROR: can't get \"ip.address, use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } const char *host_address = json_object_get_string(jObj_host_address); bpf_filter_host_array_add(dstHostArray, size, host_address); } } } #endif /* *********************************************** */ #ifdef HAVE_JSON_C void getScannerHosts(struct json_object *jObj_stat, int duration, const char *srcHostArray[48], int size, float threshold) { int j; for(j=0; j FLOWS_THRESHOLD) && tot_flows_number > threshold) { if((res = json_object_object_get_ex(scanner_stat, "ip.address", &jObj_host_address)) == 0) { fprintf(stderr, "ERROR: can't get \"ip.address\", use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } const char *host_address = json_object_get_string(jObj_host_address); bpf_filter_host_array_add(srcHostArray, size, host_address); } } } #endif /* *********************************************** */ #ifdef HAVE_JSON_C void getDestinationHosts(struct json_object *jObj_stat, int duration, const char *dstHostArray[16], int size) { int j; for(j=0; j FLOWS_PERCENT_THRESHOLD_2) { if((res = json_object_object_get_ex(scanner_stat, "aggressive.host", &jObj_host_address)) == 0) { fprintf(stderr, "ERROR: can't get \"aggressive.host\", use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } const char *host_address = json_object_get_string(jObj_host_address); bpf_filter_host_array_add(dstHostArray, size, host_address); } } } #endif /* *********************************************** */ #ifdef HAVE_JSON_C static void produceBpfFilter(char *filePath) { json_object *jObj; /* entire json object from file */ json_object *jObj_duration; json_object *jObj_statistics; /* json array */ json_bool res; int filterSrcPorts[PORT_ARRAY_SIZE]; const char *filterSrcHosts[48]; const char *filterDstHosts[48]; const char *filterPktDstHosts[48]; struct stat statbuf; FILE *fp = NULL; char *fileName; char _filterFilePath[1024]; json_object *jObj_bpfFilter; void *fmap; int fsock; float average; float deviation; int duration; int typeCheck; int array_len; int i; if((fsock = open(filePath, O_RDONLY)) == -1) { fprintf(stderr,"error opening file %s\n", filePath); exit(-1); } if(fstat(fsock, &statbuf) == -1) { fprintf(stderr,"error getting file stat\n"); exit(-1); } if((fmap = mmap(NULL, statbuf.st_size, PROT_READ, MAP_PRIVATE, fsock, 0)) == MAP_FAILED) { fprintf(stderr,"error mmap is failed\n"); exit(-1); } if((jObj = json_tokener_parse(fmap)) == NULL) { fprintf(stderr,"ERROR: invalid json file. Use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } if((res = json_object_object_get_ex(jObj, "duration.in.seconds", &jObj_duration)) == 0) { fprintf(stderr,"ERROR: can't get \"duration.in.seconds\", use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } duration = json_object_get_int(jObj_duration); if((res = json_object_object_get_ex(jObj, "statistics", &jObj_statistics)) == 0) { fprintf(stderr,"ERROR: can't get \"statistics\", use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } if((typeCheck = json_object_is_type(jObj_statistics, json_type_array)) == 0) { fprintf(stderr,"ERROR: invalid json file. Use -x flag only with .json files generated by ndpiReader -b flag.\n"); exit(-1); } array_len = json_object_array_length(jObj_statistics); bpf_filter_port_array_init(filterSrcPorts, PORT_ARRAY_SIZE); bpf_filter_host_array_init(filterSrcHosts, HOST_ARRAY_SIZE); bpf_filter_host_array_init(filterDstHosts, HOST_ARRAY_SIZE); bpf_filter_host_array_init(filterPktDstHosts, HOST_ARRAY_SIZE/2); for(i=0; itv_sec = (long)(t / 1000000); tv->tv_usec = (long)(t % 1000000); } if(tz) { if(!tzflag) { _tzset(); tzflag++; } tz->tz_minuteswest = _timezone / 60; tz->tz_dsttime = _daylight; } return 0; } #endif /* WIN32 */ nDPI-2.2/example/ndpi_util.c000066400000000000000000000754711321103654100157470ustar00rootroot00000000000000/* * ndpi_util.c * * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include #ifdef WIN32 #include /* winsock.h is included automatically */ #include #include #else #include #include #endif #ifndef ETH_P_IP #define ETH_P_IP 0x0800 /* IPv4 */ #endif #ifndef ETH_P_IPv6 #define ETH_P_IPV6 0x86dd /* IPv6 */ #endif #define SLARP 0x8035 /* Cisco Slarp */ #define CISCO_D_PROTO 0x2000 /* Cisco Discovery Protocol */ #define VLAN 0x8100 #define MPLS_UNI 0x8847 #define MPLS_MULTI 0x8848 #define PPPoE 0x8864 #define SNAP 0xaa #define BSTP 0x42 /* Bridge Spanning Tree Protocol */ /* mask for FCF */ #define WIFI_DATA 0x2 /* 0000 0010 */ #define FCF_TYPE(fc) (((fc) >> 2) & 0x3) /* 0000 0011 = 0x3 */ #define FCF_SUBTYPE(fc) (((fc) >> 4) & 0xF) /* 0000 1111 = 0xF */ #define FCF_TO_DS(fc) ((fc) & 0x0100) #define FCF_FROM_DS(fc) ((fc) & 0x0200) /* mask for Bad FCF presence */ #define BAD_FCS 0x50 /* 0101 0000 */ #define GTP_U_V1_PORT 2152 #define TZSP_PORT 37008 #ifndef DLT_LINUX_SLL #define DLT_LINUX_SLL 113 #endif #include "ndpi_main.h" #include "ndpi_util.h" /* ***************************************************** */ void ndpi_free_flow_info_half(struct ndpi_flow_info *flow) { if(flow->ndpi_flow) { ndpi_flow_free(flow->ndpi_flow); flow->ndpi_flow = NULL; } if(flow->src_id) { ndpi_free(flow->src_id); flow->src_id = NULL; } if(flow->dst_id) { ndpi_free(flow->dst_id); flow->dst_id = NULL; } } /* ***************************************************** */ extern u_int32_t current_ndpi_memory, max_ndpi_memory; /** * @brief malloc wrapper function */ static void *malloc_wrapper(size_t size) { current_ndpi_memory += size; if(current_ndpi_memory > max_ndpi_memory) max_ndpi_memory = current_ndpi_memory; return malloc(size); } /* ***************************************************** */ /** * @brief free wrapper function */ static void free_wrapper(void *freeable) { free(freeable); } /* ***************************************************** */ struct ndpi_workflow * ndpi_workflow_init(const struct ndpi_workflow_prefs * prefs, pcap_t * pcap_handle) { set_ndpi_malloc(malloc_wrapper), set_ndpi_free(free_wrapper); set_ndpi_flow_malloc(NULL), set_ndpi_flow_free(NULL); /* TODO: just needed here to init ndpi malloc wrapper */ struct ndpi_detection_module_struct * module = ndpi_init_detection_module(); struct ndpi_workflow * workflow = ndpi_calloc(1, sizeof(struct ndpi_workflow)); workflow->pcap_handle = pcap_handle; workflow->prefs = *prefs; workflow->ndpi_struct = module; if(workflow->ndpi_struct == NULL) { NDPI_LOG(0, NULL, NDPI_LOG_ERROR, "global structure initialization failed\n"); exit(-1); } workflow->ndpi_flows_root = ndpi_calloc(workflow->prefs.num_roots, sizeof(void *)); return workflow; } /* ***************************************************** */ void ndpi_flow_info_freer(void *node) { struct ndpi_flow_info *flow = (struct ndpi_flow_info*)node; ndpi_free_flow_info_half(flow); ndpi_free(flow); } /* ***************************************************** */ void ndpi_workflow_free(struct ndpi_workflow * workflow) { int i; for(i=0; iprefs.num_roots; i++) ndpi_tdestroy(workflow->ndpi_flows_root[i], ndpi_flow_info_freer); ndpi_exit_detection_module(workflow->ndpi_struct); free(workflow->ndpi_flows_root); free(workflow); } /* ***************************************************** */ int ndpi_workflow_node_cmp(const void *a, const void *b) { struct ndpi_flow_info *fa = (struct ndpi_flow_info*)a; struct ndpi_flow_info *fb = (struct ndpi_flow_info*)b; if(fa->hashval < fb->hashval) return(-1); else if(fa->hashval > fb->hashval) return(1); /* Flows have the same hash */ if(fa->vlan_id < fb->vlan_id ) return(-1); else { if(fa->vlan_id > fb->vlan_id ) return(1); } if(fa->protocol < fb->protocol ) return(-1); else { if(fa->protocol > fb->protocol ) return(1); } if( ( (fa->src_ip == fb->src_ip ) && (fa->src_port == fb->src_port) && (fa->dst_ip == fb->dst_ip ) && (fa->dst_port == fb->dst_port) ) || ( (fa->src_ip == fb->dst_ip ) && (fa->src_port == fb->dst_port) && (fa->dst_ip == fb->src_ip ) && (fa->dst_port == fb->src_port) ) ) return(0); if(fa->src_ip < fb->src_ip ) return(-1); else { if(fa->src_ip > fb->src_ip ) return(1); } if(fa->src_port < fb->src_port) return(-1); else { if(fa->src_port > fb->src_port) return(1); } if(fa->dst_ip < fb->dst_ip ) return(-1); else { if(fa->dst_ip > fb->dst_ip ) return(1); } if(fa->dst_port < fb->dst_port) return(-1); else { if(fa->dst_port > fb->dst_port) return(1); } return(0); /* notreached */ } /* ***************************************************** */ static void patchIPv6Address(char *str) { int i = 0, j = 0; while(str[i] != '\0') { if((str[i] == ':') && (str[i+1] == '0') && (str[i+2] == ':')) { str[j++] = ':'; str[j++] = ':'; i += 3; } else str[j++] = str[i++]; } if(str[j] != '\0') str[j] = '\0'; } /* ***************************************************** */ static struct ndpi_flow_info *get_ndpi_flow_info(struct ndpi_workflow * workflow, const u_int8_t version, u_int16_t vlan_id, const struct ndpi_iphdr *iph, const struct ndpi_ipv6hdr *iph6, u_int16_t ip_offset, u_int16_t ipsize, u_int16_t l4_packet_len, struct ndpi_tcphdr **tcph, struct ndpi_udphdr **udph, u_int16_t *sport, u_int16_t *dport, struct ndpi_id_struct **src, struct ndpi_id_struct **dst, u_int8_t *proto, u_int8_t **payload, u_int16_t *payload_len, u_int8_t *src_to_dst_direction) { u_int32_t idx, l4_offset, hashval; struct ndpi_flow_info flow; void *ret; u_int8_t *l3, *l4; /* Note: to keep things simple (ndpiReader is just a demo app) we handle IPv6 a-la-IPv4. */ if(version == IPVERSION) { if(ipsize < 20) return NULL; if((iph->ihl * 4) > ipsize || ipsize < ntohs(iph->tot_len) /* || (iph->frag_off & htons(0x1FFF)) != 0 */) return NULL; l4_offset = iph->ihl * 4; l3 = (u_int8_t*)iph; } else { l4_offset = sizeof(struct ndpi_ipv6hdr); l3 = (u_int8_t*)iph6; } if(l4_packet_len < 64) workflow->stats.packet_len[0]++; else if(l4_packet_len >= 64 && l4_packet_len < 128) workflow->stats.packet_len[1]++; else if(l4_packet_len >= 128 && l4_packet_len < 256) workflow->stats.packet_len[2]++; else if(l4_packet_len >= 256 && l4_packet_len < 1024) workflow->stats.packet_len[3]++; else if(l4_packet_len >= 1024 && l4_packet_len < 1500) workflow->stats.packet_len[4]++; else if(l4_packet_len >= 1500) workflow->stats.packet_len[5]++; if(l4_packet_len > workflow->stats.max_packet_len) workflow->stats.max_packet_len = l4_packet_len; *proto = iph->protocol; l4 = ((u_int8_t *) l3 + l4_offset); if(iph->protocol == IPPROTO_TCP && l4_packet_len >= 20) { u_int tcp_len; // tcp workflow->stats.tcp_count++; *tcph = (struct ndpi_tcphdr *)l4; *sport = ntohs((*tcph)->source), *dport = ntohs((*tcph)->dest); tcp_len = ndpi_min(4*(*tcph)->doff, l4_packet_len); *payload = &l4[tcp_len]; *payload_len = ndpi_max(0, l4_packet_len-4*(*tcph)->doff); } else if(iph->protocol == IPPROTO_UDP && l4_packet_len >= 8) { // udp workflow->stats.udp_count++; *udph = (struct ndpi_udphdr *)l4; *sport = ntohs((*udph)->source), *dport = ntohs((*udph)->dest); *payload = &l4[sizeof(struct ndpi_udphdr)]; *payload_len = ndpi_max(0, l4_packet_len-sizeof(struct ndpi_udphdr)); } else { // non tcp/udp protocols *sport = *dport = 0; } flow.protocol = iph->protocol, flow.vlan_id = vlan_id; flow.src_ip = iph->saddr, flow.dst_ip = iph->daddr; flow.src_port = htons(*sport), flow.dst_port = htons(*dport); flow.hashval = hashval = flow.protocol + flow.vlan_id + flow.src_ip + flow.dst_ip + flow.src_port + flow.dst_port; idx = hashval % workflow->prefs.num_roots; ret = ndpi_tfind(&flow, &workflow->ndpi_flows_root[idx], ndpi_workflow_node_cmp); if(ret == NULL) { if(workflow->stats.ndpi_flow_count == workflow->prefs.max_ndpi_flows) { NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_ERROR, "maximum flow count (%u) has been exceeded\n", workflow->prefs.max_ndpi_flows); exit(-1); } else { struct ndpi_flow_info *newflow = (struct ndpi_flow_info*)malloc(sizeof(struct ndpi_flow_info)); if(newflow == NULL) { NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_ERROR, "[NDPI] %s(1): not enough memory\n", __FUNCTION__); return(NULL); } else workflow->num_allocated_flows++; memset(newflow, 0, sizeof(struct ndpi_flow_info)); newflow->hashval = hashval; newflow->protocol = iph->protocol, newflow->vlan_id = vlan_id; newflow->src_ip = iph->saddr, newflow->dst_ip = iph->daddr; newflow->src_port = htons(*sport), newflow->dst_port = htons(*dport); newflow->ip_version = version; if(version == IPVERSION) { inet_ntop(AF_INET, &newflow->src_ip, newflow->src_name, sizeof(newflow->src_name)); inet_ntop(AF_INET, &newflow->dst_ip, newflow->dst_name, sizeof(newflow->dst_name)); } else { inet_ntop(AF_INET6, &iph6->ip6_src, newflow->src_name, sizeof(newflow->src_name)); inet_ntop(AF_INET6, &iph6->ip6_dst, newflow->dst_name, sizeof(newflow->dst_name)); /* For consistency across platforms replace :0: with :: */ patchIPv6Address(newflow->src_name), patchIPv6Address(newflow->dst_name); } if((newflow->ndpi_flow = ndpi_flow_malloc(SIZEOF_FLOW_STRUCT)) == NULL) { NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_ERROR, "[NDPI] %s(2): not enough memory\n", __FUNCTION__); free(newflow); return(NULL); } else memset(newflow->ndpi_flow, 0, SIZEOF_FLOW_STRUCT); if((newflow->src_id = ndpi_malloc(SIZEOF_ID_STRUCT)) == NULL) { NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_ERROR, "[NDPI] %s(3): not enough memory\n", __FUNCTION__); free(newflow); return(NULL); } else memset(newflow->src_id, 0, SIZEOF_ID_STRUCT); if((newflow->dst_id = ndpi_malloc(SIZEOF_ID_STRUCT)) == NULL) { NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_ERROR, "[NDPI] %s(4): not enough memory\n", __FUNCTION__); free(newflow); return(NULL); } else memset(newflow->dst_id, 0, SIZEOF_ID_STRUCT); ndpi_tsearch(newflow, &workflow->ndpi_flows_root[idx], ndpi_workflow_node_cmp); /* Add */ workflow->stats.ndpi_flow_count++; *src = newflow->src_id, *dst = newflow->dst_id; return newflow; } } else { struct ndpi_flow_info *flow = *(struct ndpi_flow_info**)ret; if(flow->src_ip == iph->saddr && flow->dst_ip == iph->daddr && flow->src_port == htons(*sport) && flow->dst_port == htons(*dport) ) *src = flow->src_id, *dst = flow->dst_id, *src_to_dst_direction = 1; else *src = flow->dst_id, *dst = flow->src_id, *src_to_dst_direction = 0, flow->bidirectional = 1; return flow; } } /* ****************************************************** */ static struct ndpi_flow_info *get_ndpi_flow_info6(struct ndpi_workflow * workflow, u_int16_t vlan_id, const struct ndpi_ipv6hdr *iph6, u_int16_t ip_offset, struct ndpi_tcphdr **tcph, struct ndpi_udphdr **udph, u_int16_t *sport, u_int16_t *dport, struct ndpi_id_struct **src, struct ndpi_id_struct **dst, u_int8_t *proto, u_int8_t **payload, u_int16_t *payload_len, u_int8_t *src_to_dst_direction) { struct ndpi_iphdr iph; memset(&iph, 0, sizeof(iph)); iph.version = IPVERSION; iph.saddr = iph6->ip6_src.u6_addr.u6_addr32[2] + iph6->ip6_src.u6_addr.u6_addr32[3]; iph.daddr = iph6->ip6_dst.u6_addr.u6_addr32[2] + iph6->ip6_dst.u6_addr.u6_addr32[3]; iph.protocol = iph6->ip6_ctlun.ip6_un1.ip6_un1_nxt; if(iph.protocol == IPPROTO_DSTOPTS /* IPv6 destination option */) { u_int8_t *options = (u_int8_t*)iph6 + sizeof(const struct ndpi_ipv6hdr); iph.protocol = options[0]; } return(get_ndpi_flow_info(workflow, 6, vlan_id, &iph, iph6, ip_offset, sizeof(struct ndpi_ipv6hdr), ntohs(iph6->ip6_ctlun.ip6_un1.ip6_un1_plen), tcph, udph, sport, dport, src, dst, proto, payload, payload_len, src_to_dst_direction)); } /* ****************************************************** */ void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_flow_info *flow) { if(!flow->ndpi_flow) return; snprintf(flow->host_server_name, sizeof(flow->host_server_name), "%s", flow->ndpi_flow->host_server_name); /* BITTORRENT */ if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_BITTORRENT) { int i, j, n = 0; for(i=0, j = 0; j < sizeof(flow->bittorent_hash)-1; i++) { sprintf(&flow->bittorent_hash[j], "%02x", flow->ndpi_flow->protos.bittorrent.hash[i]); j += 2, n += flow->ndpi_flow->protos.bittorrent.hash[i]; } if(n == 0) flow->bittorent_hash[0] = '\0'; } /* MDNS */ else if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_MDNS) { snprintf(flow->info, sizeof(flow->info), "%s", flow->ndpi_flow->protos.mdns.answer); } /* UBNTAC2 */ else if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UBNTAC2) { snprintf(flow->info, sizeof(flow->info), "%s", flow->ndpi_flow->protos.ubntac2.version); } if(flow->detected_protocol.app_protocol != NDPI_PROTOCOL_DNS) { /* SSH */ if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_SSH) { snprintf(flow->ssh_ssl.client_info, sizeof(flow->ssh_ssl.client_info), "%s", flow->ndpi_flow->protos.ssh.client_signature); snprintf(flow->ssh_ssl.server_info, sizeof(flow->ssh_ssl.server_info), "%s", flow->ndpi_flow->protos.ssh.server_signature); } /* SSL */ else if((flow->detected_protocol.app_protocol == NDPI_PROTOCOL_SSL) || (flow->detected_protocol.master_protocol == NDPI_PROTOCOL_SSL)) { snprintf(flow->ssh_ssl.client_info, sizeof(flow->ssh_ssl.client_info), "%s", flow->ndpi_flow->protos.ssl.client_certificate); snprintf(flow->ssh_ssl.server_info, sizeof(flow->ssh_ssl.server_info), "%s", flow->ndpi_flow->protos.ssl.server_certificate); } } if(flow->detection_completed && !flow->check_extra_packets) { if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) { if (workflow->__flow_giveup_callback != NULL) workflow->__flow_giveup_callback(workflow, flow, workflow->__flow_giveup_udata); } else { if (workflow->__flow_detected_callback != NULL) workflow->__flow_detected_callback(workflow, flow, workflow->__flow_detected_udata); } ndpi_free_flow_info_half(flow); } } /* ****************************************************** */ /** Function to process the packet: determine the flow of a packet and try to decode it @return: 0 if success; else != 0 @Note: ipsize = header->len - ip_offset ; rawsize = header->len */ static struct ndpi_proto packet_processing(struct ndpi_workflow * workflow, const u_int64_t time, u_int16_t vlan_id, const struct ndpi_iphdr *iph, struct ndpi_ipv6hdr *iph6, u_int16_t ip_offset, u_int16_t ipsize, u_int16_t rawsize) { struct ndpi_id_struct *src, *dst; struct ndpi_flow_info *flow = NULL; struct ndpi_flow_struct *ndpi_flow = NULL; u_int8_t proto; struct ndpi_tcphdr *tcph = NULL; struct ndpi_udphdr *udph = NULL; u_int16_t sport, dport, payload_len; u_int8_t *payload; u_int8_t src_to_dst_direction = 1; struct ndpi_proto nproto = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN }; if(iph) flow = get_ndpi_flow_info(workflow, IPVERSION, vlan_id, iph, NULL, ip_offset, ipsize, ntohs(iph->tot_len) - (iph->ihl * 4), &tcph, &udph, &sport, &dport, &src, &dst, &proto, &payload, &payload_len, &src_to_dst_direction); else flow = get_ndpi_flow_info6(workflow, vlan_id, iph6, ip_offset, &tcph, &udph, &sport, &dport, &src, &dst, &proto, &payload, &payload_len, &src_to_dst_direction); if(flow != NULL) { workflow->stats.ip_packet_count++; workflow->stats.total_wire_bytes += rawsize + 24 /* CRC etc */, workflow->stats.total_ip_bytes += rawsize; ndpi_flow = flow->ndpi_flow; if(src_to_dst_direction) flow->src2dst_packets++, flow->src2dst_bytes += rawsize; else flow->dst2src_packets++, flow->dst2src_bytes += rawsize; flow->last_seen = time; } else { // flow is NULL workflow->stats.total_discarded_bytes++; return(nproto); } /* Protocol already detected */ if(flow->detection_completed) { if(flow->check_extra_packets && ndpi_flow != NULL && ndpi_flow->check_extra_packets) { if(ndpi_flow->num_extra_packets_checked == 0 && ndpi_flow->max_extra_packets_to_check == 0) { /* Protocols can set this, but we set it here in case they didn't */ ndpi_flow->max_extra_packets_to_check = MAX_EXTRA_PACKETS_TO_CHECK; } if(ndpi_flow->num_extra_packets_checked < ndpi_flow->max_extra_packets_to_check) { ndpi_process_extra_packet(workflow->ndpi_struct, ndpi_flow, iph ? (uint8_t *)iph : (uint8_t *)iph6, ipsize, time, src, dst); if (ndpi_flow->check_extra_packets == 0) { flow->check_extra_packets = 0; process_ndpi_collected_info(workflow, flow); } } } else if (ndpi_flow != NULL) { /* If this wasn't NULL we should do the half free */ /* TODO: When half_free is deprecated, get rid of this */ ndpi_free_flow_info_half(flow); } return(flow->detected_protocol); } flow->detected_protocol = ndpi_detection_process_packet(workflow->ndpi_struct, ndpi_flow, iph ? (uint8_t *)iph : (uint8_t *)iph6, ipsize, time, src, dst); if((flow->detected_protocol.app_protocol != NDPI_PROTOCOL_UNKNOWN) || ((proto == IPPROTO_UDP) && ((flow->src2dst_packets + flow->dst2src_packets) > 8)) || ((proto == IPPROTO_TCP) && ((flow->src2dst_packets + flow->dst2src_packets) > 10))) { /* New protocol detected or give up */ flow->detection_completed = 1; /* Check if we should keep checking extra packets */ if (ndpi_flow->check_extra_packets) flow->check_extra_packets = 1; if(flow->detected_protocol.app_protocol == NDPI_PROTOCOL_UNKNOWN) flow->detected_protocol = ndpi_detection_giveup(workflow->ndpi_struct, flow->ndpi_flow); process_ndpi_collected_info(workflow, flow); } return(flow->detected_protocol); } /* ****************************************************** */ struct ndpi_proto ndpi_workflow_process_packet (struct ndpi_workflow * workflow, const struct pcap_pkthdr *header, const u_char *packet) { /* * Declare pointers to packet headers */ /* --- Ethernet header --- */ const struct ndpi_ethhdr *ethernet; /* --- LLC header --- */ const struct ndpi_llc_header_snap *llc; /* --- Cisco HDLC header --- */ const struct ndpi_chdlc *chdlc; /* --- Radio Tap header --- */ const struct ndpi_radiotap_header *radiotap; /* --- Wifi header --- */ const struct ndpi_wifi_header *wifi; /* --- MPLS header --- */ struct ndpi_mpls_header *mpls; /** --- IP header --- **/ struct ndpi_iphdr *iph; /** --- IPv6 header --- **/ struct ndpi_ipv6hdr *iph6; struct ndpi_proto nproto = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN }; /* lengths and offsets */ u_int16_t eth_offset = 0; u_int16_t radio_len; u_int16_t fc; u_int16_t type = 0; int wifi_len = 0; int pyld_eth_len = 0; int check; u_int64_t time; u_int16_t ip_offset = 0, ip_len; u_int16_t frag_off = 0, vlan_id = 0; u_int8_t proto = 0; u_int32_t label; /* counters */ u_int8_t vlan_packet = 0; /* Increment raw packet counter */ workflow->stats.raw_packet_count++; /* setting time */ time = ((uint64_t) header->ts.tv_sec) * TICK_RESOLUTION + header->ts.tv_usec / (1000000 / TICK_RESOLUTION); /* safety check */ if(workflow->last_time > time) { /* printf("\nWARNING: timestamp bug in the pcap file (ts delta: %llu, repairing)\n", ndpi_thread_info[thread_id].last_time - time); */ time = workflow->last_time; } /* update last time value */ workflow->last_time = time; /*** check Data Link type ***/ const int datalink_type = pcap_datalink(workflow->pcap_handle); datalink_check: switch(datalink_type) { case DLT_NULL: if(ntohl(*((u_int32_t*)&packet[eth_offset])) == 2) type = ETH_P_IP; else type = ETH_P_IPV6; ip_offset = 4 + eth_offset; break; /* Cisco PPP in HDLC-like framing - 50 */ case DLT_PPP_SERIAL: chdlc = (struct ndpi_chdlc *) &packet[eth_offset]; ip_offset = sizeof(struct ndpi_chdlc); /* CHDLC_OFF = 4 */ type = ntohs(chdlc->proto_code); break; /* Cisco PPP - 9 or 104 */ case DLT_C_HDLC: case DLT_PPP: chdlc = (struct ndpi_chdlc *) &packet[eth_offset]; ip_offset = sizeof(struct ndpi_chdlc); /* CHDLC_OFF = 4 */ type = ntohs(chdlc->proto_code); break; /* IEEE 802.3 Ethernet - 1 */ case DLT_EN10MB: ethernet = (struct ndpi_ethhdr *) &packet[eth_offset]; ip_offset = sizeof(struct ndpi_ethhdr) + eth_offset; check = ntohs(ethernet->h_proto); if(check <= 1500) pyld_eth_len = check; else if (check >= 1536) type = check; if(pyld_eth_len != 0) { llc = (struct ndpi_llc_header_snap *)(&packet[ip_offset]); /* check for LLC layer with SNAP extension */ if(llc->dsap == SNAP || llc->ssap == SNAP) { type = llc->snap.proto_ID; ip_offset += + 8; } /* No SNAP extension - Spanning Tree pkt must be discarted */ else if(llc->dsap == BSTP || llc->ssap == BSTP) { goto v4_warning; } } break; /* Linux Cooked Capture - 113 */ case DLT_LINUX_SLL: type = (packet[eth_offset+14] << 8) + packet[eth_offset+15]; ip_offset = 16 + eth_offset; break; /* Radiotap link-layer - 127 */ case DLT_IEEE802_11_RADIO: radiotap = (struct ndpi_radiotap_header *) &packet[eth_offset]; radio_len = radiotap->len; /* Check Bad FCS presence */ if((radiotap->flags & BAD_FCS) == BAD_FCS) { workflow->stats.total_discarded_bytes += header->len; return(nproto); } /* Calculate 802.11 header length (variable) */ wifi = (struct ndpi_wifi_header*)( packet + eth_offset + radio_len); fc = wifi->fc; /* check wifi data presence */ if(FCF_TYPE(fc) == WIFI_DATA) { if((FCF_TO_DS(fc) && FCF_FROM_DS(fc) == 0x0) || (FCF_TO_DS(fc) == 0x0 && FCF_FROM_DS(fc))) wifi_len = 26; /* + 4 byte fcs */ } else /* no data frames */ break; /* Check ether_type from LLC */ llc = (struct ndpi_llc_header_snap*)(packet + eth_offset + wifi_len + radio_len); if(llc->dsap == SNAP) type = ntohs(llc->snap.proto_ID); /* Set IP header offset */ ip_offset = wifi_len + radio_len + sizeof(struct ndpi_llc_header_snap) + eth_offset; break; case DLT_RAW: ip_offset = eth_offset = 0; break; default: /* printf("Unknown datalink %d\n", datalink_type); */ return(nproto); } /* check ether type */ switch(type) { case VLAN: vlan_id = ((packet[ip_offset] << 8) + packet[ip_offset+1]) & 0xFFF; type = (packet[ip_offset+2] << 8) + packet[ip_offset+3]; ip_offset += 4; vlan_packet = 1; // double tagging for 802.1Q if(type == 0x8100) { vlan_id = ((packet[ip_offset] << 8) + packet[ip_offset+1]) & 0xFFF; type = (packet[ip_offset+2] << 8) + packet[ip_offset+3]; ip_offset += 4; } break; case MPLS_UNI: case MPLS_MULTI: mpls = (struct ndpi_mpls_header *) &packet[ip_offset]; label = ntohl(mpls->label); /* label = ntohl(*((u_int32_t*)&packet[ip_offset])); */ workflow->stats.mpls_count++; type = ETH_P_IP, ip_offset += 4; while((label & 0x100) != 0x100) { ip_offset += 4; label = ntohl(mpls->label); } break; case PPPoE: workflow->stats.pppoe_count++; type = ETH_P_IP; ip_offset += 8; break; default: break; } workflow->stats.vlan_count += vlan_packet; iph_check: /* Check and set IP header size and total packet length */ iph = (struct ndpi_iphdr *) &packet[ip_offset]; /* just work on Ethernet packets that contain IP */ if(type == ETH_P_IP && header->caplen >= ip_offset) { frag_off = ntohs(iph->frag_off); proto = iph->protocol; if(header->caplen < header->len) { static u_int8_t cap_warning_used = 0; if(cap_warning_used == 0) { if(!workflow->prefs.quiet_mode) NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_DEBUG, "\n\nWARNING: packet capture size is smaller than packet size, DETECTION MIGHT NOT WORK CORRECTLY\n\n"); cap_warning_used = 1; } } } if(iph->version == IPVERSION) { ip_len = ((u_int16_t)iph->ihl * 4); iph6 = NULL; if(iph->protocol == IPPROTO_IPV6) { ip_offset += ip_len; goto iph_check; } if((frag_off & 0x1FFF) != 0) { static u_int8_t ipv4_frags_warning_used = 0; workflow->stats.fragmented_count++; if(ipv4_frags_warning_used == 0) { if(!workflow->prefs.quiet_mode) NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_DEBUG, "\n\nWARNING: IPv4 fragments are not handled by this demo (nDPI supports them)\n"); ipv4_frags_warning_used = 1; } workflow->stats.total_discarded_bytes += header->len; return(nproto); } } else if(iph->version == 6) { iph6 = (struct ndpi_ipv6hdr *)&packet[ip_offset]; proto = iph6->ip6_ctlun.ip6_un1.ip6_un1_nxt; ip_len = sizeof(struct ndpi_ipv6hdr); if(proto == IPPROTO_DSTOPTS /* IPv6 destination option */) { u_int8_t *options = (u_int8_t*)&packet[ip_offset+ip_len]; proto = options[0]; ip_len += 8 * (options[1] + 1); } iph = NULL; } else { static u_int8_t ipv4_warning_used = 0; v4_warning: if(ipv4_warning_used == 0) { if(!workflow->prefs.quiet_mode) NDPI_LOG(0, workflow->ndpi_struct, NDPI_LOG_DEBUG, "\n\nWARNING: only IPv4/IPv6 packets are supported in this demo (nDPI supports both IPv4 and IPv6), all other packets will be discarded\n\n"); ipv4_warning_used = 1; } workflow->stats.total_discarded_bytes += header->len; return(nproto); } if(workflow->prefs.decode_tunnels && (proto == IPPROTO_UDP)) { struct ndpi_udphdr *udp = (struct ndpi_udphdr *)&packet[ip_offset+ip_len]; u_int16_t sport = ntohs(udp->source), dport = ntohs(udp->dest); if((sport == GTP_U_V1_PORT) || (dport == GTP_U_V1_PORT)) { /* Check if it's GTPv1 */ u_int offset = ip_offset+ip_len+sizeof(struct ndpi_udphdr); u_int8_t flags = packet[offset]; u_int8_t message_type = packet[offset+1]; if((((flags & 0xE0) >> 5) == 1 /* GTPv1 */) && (message_type == 0xFF /* T-PDU */)) { ip_offset = ip_offset+ip_len+sizeof(struct ndpi_udphdr)+8; /* GTPv1 header len */ if(flags & 0x04) ip_offset += 1; /* next_ext_header is present */ if(flags & 0x02) ip_offset += 4; /* sequence_number is present (it also includes next_ext_header and pdu_number) */ if(flags & 0x01) ip_offset += 1; /* pdu_number is present */ iph = (struct ndpi_iphdr *) &packet[ip_offset]; if(iph->version != IPVERSION) { // printf("WARNING: not good (packet_id=%u)!\n", (unsigned int)workflow->stats.raw_packet_count); goto v4_warning; } } } else if((sport == TZSP_PORT) || (dport == TZSP_PORT)) { /* https://en.wikipedia.org/wiki/TZSP */ u_int offset = ip_offset+ip_len+sizeof(struct ndpi_udphdr); u_int8_t version = packet[offset]; u_int8_t type = packet[offset+1]; u_int16_t encapsulates = ntohs(*((u_int16_t*)&packet[offset+2])); if((version == 1) && (type == 0) && (encapsulates == 1)) { u_int8_t stop = 0; offset += 4; while((!stop) && (offset < header->caplen)) { u_int8_t tag_type = packet[offset]; u_int8_t tag_len; switch(tag_type) { case 0: /* PADDING Tag */ tag_len = 1; break; case 1: /* END Tag */ tag_len = 1, stop = 1; break; default: tag_len = packet[offset+1]; break; } offset += tag_len; if(offset >= header->caplen) return(nproto); /* Invalid packet */ else { eth_offset = offset; goto datalink_check; } } } } } /* process the packet */ return(packet_processing(workflow, time, vlan_id, iph, iph6, ip_offset, header->caplen - ip_offset, header->caplen)); } /* ********************************************************** */ /* http://home.thep.lu.se/~bjorn/crc/crc32_fast.c */ /* ********************************************************** */ static uint32_t crc32_for_byte(uint32_t r) { int j; for(j = 0; j < 8; ++j) r = (r & 1? 0: (uint32_t)0xEDB88320L) ^ r >> 1; return r ^ (uint32_t)0xFF000000L; } /* Any unsigned integer type with at least 32 bits may be used as * accumulator type for fast crc32-calulation, but unsigned long is * probably the optimal choice for most systems. */ typedef unsigned long accum_t; static void init_tables(uint32_t* table, uint32_t* wtable) { size_t i, j, k, w; for(i = 0; i < 0x100; ++i) table[i] = crc32_for_byte(i); for(k = 0; k < sizeof(accum_t); ++k) for(i = 0; i < 0x100; ++i) { for(j = w = 0; j < sizeof(accum_t); ++j) w = table[(uint8_t)(j == k? w ^ i: w)] ^ w >> 8; wtable[(k << 8) + i] = w ^ (k? wtable[0]: 0); } } static void __crc32(const void* data, size_t n_bytes, uint32_t* crc) { static uint32_t table[0x100], wtable[0x100*sizeof(accum_t)]; size_t n_accum = n_bytes/sizeof(accum_t); size_t i, j; if(!*table) init_tables(table, wtable); for(i = 0; i < n_accum; ++i) { accum_t a = *crc ^ ((accum_t*)data)[i]; for(j = *crc = 0; j < sizeof(accum_t); ++j) *crc ^= wtable[(j << 8) + (uint8_t)(a >> 8*j)]; } for(i = n_accum*sizeof(accum_t); i < n_bytes; ++i) *crc = table[(uint8_t)*crc ^ ((uint8_t*)data)[i]] ^ *crc >> 8; } u_int32_t ethernet_crc32(const void* data, size_t n_bytes) { u_int32_t crc = 0; __crc32(data, n_bytes, &crc); return crc; } nDPI-2.2/example/ndpi_util.h000066400000000000000000000135431321103654100157440ustar00rootroot00000000000000/* * ndpi_util.h * * Copyright (C) 2011-16 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /** * This module contains routines to help setup a simple nDPI program. * * If you concern about performance or have to integrate nDPI in your * application, you could need to reimplement them yourself. * * WARNING: this API is unstable! Use it at your own risk! */ #ifndef __NDPI_UTIL_H__ #define __NDPI_UTIL_H__ #include #define MAX_NUM_READER_THREADS 16 #define IDLE_SCAN_PERIOD 10 /* msec (use TICK_RESOLUTION = 1000) */ #define MAX_IDLE_TIME 30000 #define IDLE_SCAN_BUDGET 1024 #define NUM_ROOTS 512 #define MAX_EXTRA_PACKETS_TO_CHECK 7 #define MAX_NDPI_FLOWS 200000000 #define TICK_RESOLUTION 1000 #define MAX_NUM_IP_ADDRESS 5 /* len of ip address array */ #define UPDATED_TREE 1 #define AGGRESSIVE_PERCENT 95.00 #define DIR_SRC 10 #define DIR_DST 20 #define PORT_ARRAY_SIZE 20 #define HOST_ARRAY_SIZE 20 #define FLOWS_PACKETS_THRESHOLD 0.9 #define FLOWS_PERCENT_THRESHOLD 1.0 #define FLOWS_PERCENT_THRESHOLD_2 0.2 #define FLOWS_THRESHOLD 1000 #define PKTS_PERCENT_THRESHOLD 0.1 #define MAX_TABLE_SIZE_1 4096 #define MAX_TABLE_SIZE_2 8192 #define INIT_VAL -1 // flow tracking typedef struct ndpi_flow_info { u_int32_t hashval; u_int32_t src_ip; u_int32_t dst_ip; u_int16_t src_port; u_int16_t dst_port; u_int8_t detection_completed, protocol, bidirectional, check_extra_packets; u_int16_t vlan_id; struct ndpi_flow_struct *ndpi_flow; char src_name[48], dst_name[48]; u_int8_t ip_version; u_int64_t last_seen; u_int64_t src2dst_bytes, dst2src_bytes; u_int32_t src2dst_packets, dst2src_packets; // result only, not used for flow identification ndpi_protocol detected_protocol; char info[96]; char host_server_name[192]; char bittorent_hash[41]; struct { char client_info[48], server_info[48]; } ssh_ssl; void *src_id, *dst_id; } ndpi_flow_info_t; // flow statistics info typedef struct ndpi_stats { u_int32_t guessed_flow_protocols; u_int64_t raw_packet_count; u_int64_t ip_packet_count; u_int64_t total_wire_bytes, total_ip_bytes, total_discarded_bytes; u_int64_t protocol_counter[NDPI_MAX_SUPPORTED_PROTOCOLS + NDPI_MAX_NUM_CUSTOM_PROTOCOLS + 1]; u_int64_t protocol_counter_bytes[NDPI_MAX_SUPPORTED_PROTOCOLS + NDPI_MAX_NUM_CUSTOM_PROTOCOLS + 1]; u_int32_t protocol_flows[NDPI_MAX_SUPPORTED_PROTOCOLS + NDPI_MAX_NUM_CUSTOM_PROTOCOLS + 1]; u_int32_t ndpi_flow_count; u_int64_t tcp_count, udp_count; u_int64_t mpls_count, pppoe_count, vlan_count, fragmented_count; u_int64_t packet_len[6]; u_int16_t max_packet_len; } ndpi_stats_t; // flow preferences typedef struct ndpi_workflow_prefs { u_int8_t decode_tunnels; u_int8_t quiet_mode; u_int32_t num_roots; u_int32_t max_ndpi_flows; } ndpi_workflow_prefs_t; struct ndpi_workflow; /** workflow, flow, user data */ typedef void (*ndpi_workflow_callback_ptr) (struct ndpi_workflow *, struct ndpi_flow_info *, void *); // workflow main structure typedef struct ndpi_workflow { u_int64_t last_time; struct ndpi_workflow_prefs prefs; struct ndpi_stats stats; ndpi_workflow_callback_ptr __flow_detected_callback; void * __flow_detected_udata; ndpi_workflow_callback_ptr __flow_giveup_callback; void * __flow_giveup_udata; /* outside referencies */ pcap_t *pcap_handle; /* allocated by prefs */ void **ndpi_flows_root; struct ndpi_detection_module_struct *ndpi_struct; u_int32_t num_allocated_flows; } ndpi_workflow_t; /* TODO: remove wrappers parameters and use ndpi global, when their initialization will be fixed... */ struct ndpi_workflow * ndpi_workflow_init(const struct ndpi_workflow_prefs * prefs, pcap_t * pcap_handle); /* workflow main free function */ void ndpi_workflow_free(struct ndpi_workflow * workflow); /** Free flow_info ndpi support structures but not the flow_info itself * * TODO remove! Half freeing things is bad! */ void ndpi_free_flow_info_half(struct ndpi_flow_info *flow); /* Process a packet and update the workflow */ struct ndpi_proto ndpi_workflow_process_packet(struct ndpi_workflow * workflow, const struct pcap_pkthdr *header, const u_char *packet); /* flow callbacks for complete detected flow (ndpi_flow_info will be freed right after) */ static inline void ndpi_workflow_set_flow_detected_callback(struct ndpi_workflow * workflow, ndpi_workflow_callback_ptr callback, void * udata) { workflow->__flow_detected_callback = callback; workflow->__flow_detected_udata = udata; } /* flow callbacks for sufficient detected flow (ndpi_flow_info will be freed right after) */ static inline void ndpi_workflow_set_flow_giveup_callback(struct ndpi_workflow * workflow, ndpi_workflow_callback_ptr callback, void * udata) { workflow->__flow_giveup_callback = callback; workflow->__flow_giveup_udata = udata; } /* compare two nodes in workflow */ int ndpi_workflow_node_cmp(const void *a, const void *b); void process_ndpi_collected_info(struct ndpi_workflow * workflow, struct ndpi_flow_info *flow); u_int32_t ethernet_crc32(const void* data, size_t n_bytes); void ndpi_flow_info_freer(void *node); #endif nDPI-2.2/example/protos.txt000066400000000000000000000007351321103654100156720ustar00rootroot00000000000000# Format: # :,:,.....@ tcp:81,tcp:8181@HTTP udp:5061-5062@SIP tcp:860,udp:860,tcp:3260,udp:3260@iSCSI tcp:3000@ntop # Subprotocols # Format: # host:"",host:"",.....@ host:"googlesyndication.com"@Google host:"venere.com"@Venere host:"kataweb.it",host:"repubblica.it"@Repubblica host:"ntop"@ntop # IP based Subprotocols # Format: # ip:,ip:,.....@ ip:213.75.170.11@CustomProtocol nDPI-2.2/example/uthash.h000066400000000000000000002121771321103654100152550ustar00rootroot00000000000000/* Copyright (c) 2003-2017, Troy D. Hanson http://troydhanson.github.com/uthash/ All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: * Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef UTHASH_H #define UTHASH_H #define UTHASH_VERSION 2.0.2 #include /* memcmp,strlen */ #include /* ptrdiff_t */ #include /* exit() */ /* These macros use decltype or the earlier __typeof GNU extension. As decltype is only available in newer compilers (VS2010 or gcc 4.3+ when compiling c++ source) this code uses whatever method is needed or, for VS2008 where neither is available, uses casting workarounds. */ #if !defined(DECLTYPE) && !defined(NO_DECLTYPE) #if defined(_MSC_VER) /* MS compiler */ #if _MSC_VER >= 1600 && defined(__cplusplus) /* VS2010 or newer in C++ mode */ #define DECLTYPE(x) (decltype(x)) #else /* VS2008 or older (or VS2010 in C mode) */ #define NO_DECLTYPE #endif #elif defined(__BORLANDC__) || defined(__ICCARM__) || defined(__LCC__) || defined(__WATCOMC__) #define NO_DECLTYPE #else /* GNU, Sun and other compilers */ #define DECLTYPE(x) (__typeof(x)) #endif #endif #ifdef NO_DECLTYPE #define DECLTYPE(x) #define DECLTYPE_ASSIGN(dst,src) \ do { \ char **_da_dst = (char**)(&(dst)); \ *_da_dst = (char*)(src); \ } while (0) #else #define DECLTYPE_ASSIGN(dst,src) \ do { \ (dst) = DECLTYPE(dst)(src); \ } while (0) #endif /* a number of the hash function use uint32_t which isn't defined on Pre VS2010 */ #if defined(_WIN32) #if defined(_MSC_VER) && _MSC_VER >= 1600 #include #elif defined(__WATCOMC__) || defined(__MINGW32__) || defined(__CYGWIN__) #include #else typedef unsigned int uint32_t; typedef unsigned char uint8_t; #endif #elif defined(__GNUC__) && !defined(__VXWORKS__) #include #else typedef unsigned int uint32_t; typedef unsigned char uint8_t; #endif #ifndef uthash_fatal #define uthash_fatal(msg) exit(-1) /* fatal error (out of memory,etc) */ #endif #ifndef uthash_malloc #define uthash_malloc(sz) malloc(sz) /* malloc fcn */ #endif #ifndef uthash_free #define uthash_free(ptr,sz) free(ptr) /* free fcn */ #endif #ifndef uthash_strlen #define uthash_strlen(s) strlen(s) #endif #ifndef uthash_memcmp #define uthash_memcmp(a,b,n) memcmp(a,b,n) #endif #ifndef uthash_noexpand_fyi #define uthash_noexpand_fyi(tbl) /* can be defined to log noexpand */ #endif #ifndef uthash_expand_fyi #define uthash_expand_fyi(tbl) /* can be defined to log expands */ #endif /* initial number of buckets */ #define HASH_INITIAL_NUM_BUCKETS 32U /* initial number of buckets */ #define HASH_INITIAL_NUM_BUCKETS_LOG2 5U /* lg2 of initial number of buckets */ #define HASH_BKT_CAPACITY_THRESH 10U /* expand when bucket count reaches */ /* calculate the element whose hash handle address is hhp */ #define ELMT_FROM_HH(tbl,hhp) ((void*)(((char*)(hhp)) - ((tbl)->hho))) /* calculate the hash handle from element address elp */ #define HH_FROM_ELMT(tbl,elp) ((UT_hash_handle *)(((char*)(elp)) + ((tbl)->hho))) #define HASH_VALUE(keyptr,keylen,hashv) \ do { \ HASH_FCN(keyptr, keylen, hashv); \ } while (0) #define HASH_FIND_BYHASHVALUE(hh,head,keyptr,keylen,hashval,out) \ do { \ (out) = NULL; \ if (head) { \ unsigned _hf_bkt; \ HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _hf_bkt); \ if (HASH_BLOOM_TEST((head)->hh.tbl, hashval) != 0) { \ HASH_FIND_IN_BKT((head)->hh.tbl, hh, (head)->hh.tbl->buckets[ _hf_bkt ], keyptr, keylen, hashval, out); \ } \ } \ } while (0) #define HASH_FIND(hh,head,keyptr,keylen,out) \ do { \ unsigned _hf_hashv; \ HASH_VALUE(keyptr, keylen, _hf_hashv); \ HASH_FIND_BYHASHVALUE(hh, head, keyptr, keylen, _hf_hashv, out); \ } while (0) #ifdef HASH_BLOOM #define HASH_BLOOM_BITLEN (1UL << HASH_BLOOM) #define HASH_BLOOM_BYTELEN (HASH_BLOOM_BITLEN/8UL) + (((HASH_BLOOM_BITLEN%8UL)!=0UL) ? 1UL : 0UL) #define HASH_BLOOM_MAKE(tbl) \ do { \ (tbl)->bloom_nbits = HASH_BLOOM; \ (tbl)->bloom_bv = (uint8_t*)uthash_malloc(HASH_BLOOM_BYTELEN); \ if (!((tbl)->bloom_bv)) { uthash_fatal( "out of memory"); } \ memset((tbl)->bloom_bv, 0, HASH_BLOOM_BYTELEN); \ (tbl)->bloom_sig = HASH_BLOOM_SIGNATURE; \ } while (0) #define HASH_BLOOM_FREE(tbl) \ do { \ uthash_free((tbl)->bloom_bv, HASH_BLOOM_BYTELEN); \ } while (0) #define HASH_BLOOM_BITSET(bv,idx) (bv[(idx)/8U] |= (1U << ((idx)%8U))) #define HASH_BLOOM_BITTEST(bv,idx) (bv[(idx)/8U] & (1U << ((idx)%8U))) #define HASH_BLOOM_ADD(tbl,hashv) \ HASH_BLOOM_BITSET((tbl)->bloom_bv, (hashv & (uint32_t)((1ULL << (tbl)->bloom_nbits) - 1U))) #define HASH_BLOOM_TEST(tbl,hashv) \ HASH_BLOOM_BITTEST((tbl)->bloom_bv, (hashv & (uint32_t)((1ULL << (tbl)->bloom_nbits) - 1U))) #else #define HASH_BLOOM_MAKE(tbl) #define HASH_BLOOM_FREE(tbl) #define HASH_BLOOM_ADD(tbl,hashv) #define HASH_BLOOM_TEST(tbl,hashv) (1) #define HASH_BLOOM_BYTELEN 0U #endif #define HASH_MAKE_TABLE(hh,head) \ do { \ (head)->hh.tbl = (UT_hash_table*)uthash_malloc( \ sizeof(UT_hash_table)); \ if (!((head)->hh.tbl)) { uthash_fatal( "out of memory"); } \ memset((head)->hh.tbl, 0, sizeof(UT_hash_table)); \ (head)->hh.tbl->tail = &((head)->hh); \ (head)->hh.tbl->num_buckets = HASH_INITIAL_NUM_BUCKETS; \ (head)->hh.tbl->log2_num_buckets = HASH_INITIAL_NUM_BUCKETS_LOG2; \ (head)->hh.tbl->hho = (char*)(&(head)->hh) - (char*)(head); \ (head)->hh.tbl->buckets = (UT_hash_bucket*)uthash_malloc( \ HASH_INITIAL_NUM_BUCKETS*sizeof(struct UT_hash_bucket)); \ if (! (head)->hh.tbl->buckets) { uthash_fatal( "out of memory"); } \ memset((head)->hh.tbl->buckets, 0, \ HASH_INITIAL_NUM_BUCKETS*sizeof(struct UT_hash_bucket)); \ HASH_BLOOM_MAKE((head)->hh.tbl); \ (head)->hh.tbl->signature = HASH_SIGNATURE; \ } while (0) #define HASH_REPLACE_BYHASHVALUE_INORDER(hh,head,fieldname,keylen_in,hashval,add,replaced,cmpfcn) \ do { \ (replaced) = NULL; \ HASH_FIND_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, replaced); \ if (replaced) { \ HASH_DELETE(hh, head, replaced); \ } \ HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, &((add)->fieldname), keylen_in, hashval, add, cmpfcn); \ } while (0) #define HASH_REPLACE_BYHASHVALUE(hh,head,fieldname,keylen_in,hashval,add,replaced) \ do { \ (replaced) = NULL; \ HASH_FIND_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, replaced); \ if (replaced) { \ HASH_DELETE(hh, head, replaced); \ } \ HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, add); \ } while (0) #define HASH_REPLACE(hh,head,fieldname,keylen_in,add,replaced) \ do { \ unsigned _hr_hashv; \ HASH_VALUE(&((add)->fieldname), keylen_in, _hr_hashv); \ HASH_REPLACE_BYHASHVALUE(hh, head, fieldname, keylen_in, _hr_hashv, add, replaced); \ } while (0) #define HASH_REPLACE_INORDER(hh,head,fieldname,keylen_in,add,replaced,cmpfcn) \ do { \ unsigned _hr_hashv; \ HASH_VALUE(&((add)->fieldname), keylen_in, _hr_hashv); \ HASH_REPLACE_BYHASHVALUE_INORDER(hh, head, fieldname, keylen_in, _hr_hashv, add, replaced, cmpfcn); \ } while (0) #define HASH_APPEND_LIST(hh, head, add) \ do { \ (add)->hh.next = NULL; \ (add)->hh.prev = ELMT_FROM_HH((head)->hh.tbl, (head)->hh.tbl->tail); \ (head)->hh.tbl->tail->next = (add); \ (head)->hh.tbl->tail = &((add)->hh); \ } while (0) #define HASH_AKBI_INNER_LOOP(hh,head,add,cmpfcn) \ do { \ do { \ if (cmpfcn(DECLTYPE(head)(_hs_iter), add) > 0) \ break; \ } while ((_hs_iter = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->next)); \ } while (0) #ifdef NO_DECLTYPE #undef HASH_AKBI_INNER_LOOP #define HASH_AKBI_INNER_LOOP(hh,head,add,cmpfcn) \ do { \ char *_hs_saved_head = (char*)(head); \ do { \ DECLTYPE_ASSIGN(head, _hs_iter); \ if (cmpfcn(head, add) > 0) { \ DECLTYPE_ASSIGN(head, _hs_saved_head); \ break; \ } \ DECLTYPE_ASSIGN(head, _hs_saved_head); \ } while ((_hs_iter = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->next)); \ } while (0) #endif #define HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh,head,keyptr,keylen_in,hashval,add,cmpfcn) \ do { \ unsigned _ha_bkt; \ (add)->hh.hashv = (hashval); \ (add)->hh.key = (char*) (keyptr); \ (add)->hh.keylen = (unsigned) (keylen_in); \ if (!(head)) { \ (add)->hh.next = NULL; \ (add)->hh.prev = NULL; \ (head) = (add); \ HASH_MAKE_TABLE(hh, head); \ } else { \ void *_hs_iter = (head); \ (add)->hh.tbl = (head)->hh.tbl; \ HASH_AKBI_INNER_LOOP(hh, head, add, cmpfcn); \ if (_hs_iter) { \ (add)->hh.next = _hs_iter; \ if (((add)->hh.prev = HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->prev)) { \ HH_FROM_ELMT((head)->hh.tbl, (add)->hh.prev)->next = (add); \ } else { \ (head) = (add); \ } \ HH_FROM_ELMT((head)->hh.tbl, _hs_iter)->prev = (add); \ } else { \ HASH_APPEND_LIST(hh, head, add); \ } \ } \ (head)->hh.tbl->num_items++; \ HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _ha_bkt); \ HASH_ADD_TO_BKT((head)->hh.tbl->buckets[_ha_bkt], &(add)->hh); \ HASH_BLOOM_ADD((head)->hh.tbl, hashval); \ HASH_EMIT_KEY(hh, head, keyptr, keylen_in); \ HASH_FSCK(hh, head); \ } while (0) #define HASH_ADD_KEYPTR_INORDER(hh,head,keyptr,keylen_in,add,cmpfcn) \ do { \ unsigned _hs_hashv; \ HASH_VALUE(keyptr, keylen_in, _hs_hashv); \ HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, keyptr, keylen_in, _hs_hashv, add, cmpfcn); \ } while (0) #define HASH_ADD_BYHASHVALUE_INORDER(hh,head,fieldname,keylen_in,hashval,add,cmpfcn) \ HASH_ADD_KEYPTR_BYHASHVALUE_INORDER(hh, head, &((add)->fieldname), keylen_in, hashval, add, cmpfcn) #define HASH_ADD_INORDER(hh,head,fieldname,keylen_in,add,cmpfcn) \ HASH_ADD_KEYPTR_INORDER(hh, head, &((add)->fieldname), keylen_in, add, cmpfcn) #define HASH_ADD_KEYPTR_BYHASHVALUE(hh,head,keyptr,keylen_in,hashval,add) \ do { \ unsigned _ha_bkt; \ (add)->hh.hashv = (hashval); \ (add)->hh.key = (char*) (keyptr); \ (add)->hh.keylen = (unsigned) (keylen_in); \ if (!(head)) { \ (add)->hh.next = NULL; \ (add)->hh.prev = NULL; \ (head) = (add); \ HASH_MAKE_TABLE(hh, head); \ } else { \ (add)->hh.tbl = (head)->hh.tbl; \ HASH_APPEND_LIST(hh, head, add); \ } \ (head)->hh.tbl->num_items++; \ HASH_TO_BKT(hashval, (head)->hh.tbl->num_buckets, _ha_bkt); \ HASH_ADD_TO_BKT((head)->hh.tbl->buckets[_ha_bkt], &(add)->hh); \ HASH_BLOOM_ADD((head)->hh.tbl, hashval); \ HASH_EMIT_KEY(hh, head, keyptr, keylen_in); \ HASH_FSCK(hh, head); \ } while (0) #define HASH_ADD_KEYPTR(hh,head,keyptr,keylen_in,add) \ do { \ unsigned _ha_hashv; \ HASH_VALUE(keyptr, keylen_in, _ha_hashv); \ HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, keyptr, keylen_in, _ha_hashv, add); \ } while (0) #define HASH_ADD_BYHASHVALUE(hh,head,fieldname,keylen_in,hashval,add) \ HASH_ADD_KEYPTR_BYHASHVALUE(hh, head, &((add)->fieldname), keylen_in, hashval, add) #define HASH_ADD(hh,head,fieldname,keylen_in,add) \ HASH_ADD_KEYPTR(hh, head, &((add)->fieldname), keylen_in, add) #define HASH_TO_BKT(hashv,num_bkts,bkt) \ do { \ bkt = ((hashv) & ((num_bkts) - 1U)); \ } while (0) /* delete "delptr" from the hash table. * "the usual" patch-up process for the app-order doubly-linked-list. * The use of _hd_hh_del below deserves special explanation. * These used to be expressed using (delptr) but that led to a bug * if someone used the same symbol for the head and deletee, like * HASH_DELETE(hh,users,users); * We want that to work, but by changing the head (users) below * we were forfeiting our ability to further refer to the deletee (users) * in the patch-up process. Solution: use scratch space to * copy the deletee pointer, then the latter references are via that * scratch pointer rather than through the repointed (users) symbol. */ #define HASH_DELETE(hh,head,delptr) \ do { \ struct UT_hash_handle *_hd_hh_del; \ if ( ((delptr)->hh.prev == NULL) && ((delptr)->hh.next == NULL) ) { \ uthash_free((head)->hh.tbl->buckets, \ (head)->hh.tbl->num_buckets*sizeof(struct UT_hash_bucket) ); \ HASH_BLOOM_FREE((head)->hh.tbl); \ uthash_free((head)->hh.tbl, sizeof(UT_hash_table)); \ head = NULL; \ } else { \ unsigned _hd_bkt; \ _hd_hh_del = &((delptr)->hh); \ if ((delptr) == ELMT_FROM_HH((head)->hh.tbl,(head)->hh.tbl->tail)) { \ (head)->hh.tbl->tail = \ (UT_hash_handle*)((ptrdiff_t)((delptr)->hh.prev) + \ (head)->hh.tbl->hho); \ } \ if ((delptr)->hh.prev != NULL) { \ ((UT_hash_handle*)((ptrdiff_t)((delptr)->hh.prev) + \ (head)->hh.tbl->hho))->next = (delptr)->hh.next; \ } else { \ DECLTYPE_ASSIGN(head,(delptr)->hh.next); \ } \ if (_hd_hh_del->next != NULL) { \ ((UT_hash_handle*)((ptrdiff_t)_hd_hh_del->next + \ (head)->hh.tbl->hho))->prev = \ _hd_hh_del->prev; \ } \ HASH_TO_BKT( _hd_hh_del->hashv, (head)->hh.tbl->num_buckets, _hd_bkt); \ HASH_DEL_IN_BKT(hh,(head)->hh.tbl->buckets[_hd_bkt], _hd_hh_del); \ (head)->hh.tbl->num_items--; \ } \ HASH_FSCK(hh,head); \ } while (0) /* convenience forms of HASH_FIND/HASH_ADD/HASH_DEL */ #define HASH_FIND_STR(head,findstr,out) \ HASH_FIND(hh,head,findstr,(unsigned)uthash_strlen(findstr),out) #define HASH_ADD_STR(head,strfield,add) \ HASH_ADD(hh,head,strfield[0],(unsigned)uthash_strlen(add->strfield),add) #define HASH_REPLACE_STR(head,strfield,add,replaced) \ HASH_REPLACE(hh,head,strfield[0],(unsigned)uthash_strlen(add->strfield),add,replaced) #define HASH_FIND_INT(head,findint,out) \ HASH_FIND(hh,head,findint,sizeof(int),out) #define HASH_ADD_INT(head,intfield,add) \ HASH_ADD(hh,head,intfield,sizeof(int),add) #define HASH_REPLACE_INT(head,intfield,add,replaced) \ HASH_REPLACE(hh,head,intfield,sizeof(int),add,replaced) #define HASH_FIND_PTR(head,findptr,out) \ HASH_FIND(hh,head,findptr,sizeof(void *),out) #define HASH_ADD_PTR(head,ptrfield,add) \ HASH_ADD(hh,head,ptrfield,sizeof(void *),add) #define HASH_REPLACE_PTR(head,ptrfield,add,replaced) \ HASH_REPLACE(hh,head,ptrfield,sizeof(void *),add,replaced) #define HASH_DEL(head,delptr) \ HASH_DELETE(hh,head,delptr) /* HASH_FSCK checks hash integrity on every add/delete when HASH_DEBUG is defined. * This is for uthash developer only; it compiles away if HASH_DEBUG isn't defined. */ #ifdef HASH_DEBUG #define HASH_OOPS(...) do { fprintf(stderr,__VA_ARGS__); exit(-1); } while (0) #define HASH_FSCK(hh,head) \ do { \ struct UT_hash_handle *_thh; \ if (head) { \ unsigned _bkt_i; \ unsigned _count; \ char *_prev; \ _count = 0; \ for( _bkt_i = 0; _bkt_i < (head)->hh.tbl->num_buckets; _bkt_i++) { \ unsigned _bkt_count = 0; \ _thh = (head)->hh.tbl->buckets[_bkt_i].hh_head; \ _prev = NULL; \ while (_thh) { \ if (_prev != (char*)(_thh->hh_prev)) { \ HASH_OOPS("invalid hh_prev %p, actual %p\n", \ _thh->hh_prev, _prev ); \ } \ _bkt_count++; \ _prev = (char*)(_thh); \ _thh = _thh->hh_next; \ } \ _count += _bkt_count; \ if ((head)->hh.tbl->buckets[_bkt_i].count != _bkt_count) { \ HASH_OOPS("invalid bucket count %u, actual %u\n", \ (head)->hh.tbl->buckets[_bkt_i].count, _bkt_count); \ } \ } \ if (_count != (head)->hh.tbl->num_items) { \ HASH_OOPS("invalid hh item count %u, actual %u\n", \ (head)->hh.tbl->num_items, _count ); \ } \ /* traverse hh in app order; check next/prev integrity, count */ \ _count = 0; \ _prev = NULL; \ _thh = &(head)->hh; \ while (_thh) { \ _count++; \ if (_prev !=(char*)(_thh->prev)) { \ HASH_OOPS("invalid prev %p, actual %p\n", \ _thh->prev, _prev ); \ } \ _prev = (char*)ELMT_FROM_HH((head)->hh.tbl, _thh); \ _thh = ( _thh->next ? (UT_hash_handle*)((char*)(_thh->next) + \ (head)->hh.tbl->hho) : NULL ); \ } \ if (_count != (head)->hh.tbl->num_items) { \ HASH_OOPS("invalid app item count %u, actual %u\n", \ (head)->hh.tbl->num_items, _count ); \ } \ } \ } while (0) #else #define HASH_FSCK(hh,head) #endif /* When compiled with -DHASH_EMIT_KEYS, length-prefixed keys are emitted to * the descriptor to which this macro is defined for tuning the hash function. * The app can #include to get the prototype for write(2). */ #ifdef HASH_EMIT_KEYS #define HASH_EMIT_KEY(hh,head,keyptr,fieldlen) \ do { \ unsigned _klen = fieldlen; \ write(HASH_EMIT_KEYS, &_klen, sizeof(_klen)); \ write(HASH_EMIT_KEYS, keyptr, (unsigned long)fieldlen); \ } while (0) #else #define HASH_EMIT_KEY(hh,head,keyptr,fieldlen) #endif /* default to Jenkin's hash unless overridden e.g. DHASH_FUNCTION=HASH_SAX */ #ifdef HASH_FUNCTION #define HASH_FCN HASH_FUNCTION #else #define HASH_FCN HASH_JEN #endif /* The Bernstein hash function, used in Perl prior to v5.6. Note (x<<5+x)=x*33. */ #define HASH_BER(key,keylen,hashv) \ do { \ unsigned _hb_keylen=(unsigned)keylen; \ const unsigned char *_hb_key=(const unsigned char*)(key); \ (hashv) = 0; \ while (_hb_keylen-- != 0U) { \ (hashv) = (((hashv) << 5) + (hashv)) + *_hb_key++; \ } \ } while (0) /* SAX/FNV/OAT/JEN hash functions are macro variants of those listed at * http://eternallyconfuzzled.com/tuts/algorithms/jsw_tut_hashing.aspx */ #define HASH_SAX(key,keylen,hashv) \ do { \ unsigned _sx_i; \ const unsigned char *_hs_key=(const unsigned char*)(key); \ hashv = 0; \ for(_sx_i=0; _sx_i < keylen; _sx_i++) { \ hashv ^= (hashv << 5) + (hashv >> 2) + _hs_key[_sx_i]; \ } \ } while (0) /* FNV-1a variation */ #define HASH_FNV(key,keylen,hashv) \ do { \ unsigned _fn_i; \ const unsigned char *_hf_key=(const unsigned char*)(key); \ hashv = 2166136261U; \ for(_fn_i=0; _fn_i < keylen; _fn_i++) { \ hashv = hashv ^ _hf_key[_fn_i]; \ hashv = hashv * 16777619U; \ } \ } while (0) #define HASH_OAT(key,keylen,hashv) \ do { \ unsigned _ho_i; \ const unsigned char *_ho_key=(const unsigned char*)(key); \ hashv = 0; \ for(_ho_i=0; _ho_i < keylen; _ho_i++) { \ hashv += _ho_key[_ho_i]; \ hashv += (hashv << 10); \ hashv ^= (hashv >> 6); \ } \ hashv += (hashv << 3); \ hashv ^= (hashv >> 11); \ hashv += (hashv << 15); \ } while (0) #define HASH_JEN_MIX(a,b,c) \ do { \ a -= b; a -= c; a ^= ( c >> 13 ); \ b -= c; b -= a; b ^= ( a << 8 ); \ c -= a; c -= b; c ^= ( b >> 13 ); \ a -= b; a -= c; a ^= ( c >> 12 ); \ b -= c; b -= a; b ^= ( a << 16 ); \ c -= a; c -= b; c ^= ( b >> 5 ); \ a -= b; a -= c; a ^= ( c >> 3 ); \ b -= c; b -= a; b ^= ( a << 10 ); \ c -= a; c -= b; c ^= ( b >> 15 ); \ } while (0) #define HASH_JEN(key,keylen,hashv) \ do { \ unsigned _hj_i,_hj_j,_hj_k; \ unsigned const char *_hj_key=(unsigned const char*)(key); \ hashv = 0xfeedbeefu; \ _hj_i = _hj_j = 0x9e3779b9u; \ _hj_k = (unsigned)(keylen); \ while (_hj_k >= 12U) { \ _hj_i += (_hj_key[0] + ( (unsigned)_hj_key[1] << 8 ) \ + ( (unsigned)_hj_key[2] << 16 ) \ + ( (unsigned)_hj_key[3] << 24 ) ); \ _hj_j += (_hj_key[4] + ( (unsigned)_hj_key[5] << 8 ) \ + ( (unsigned)_hj_key[6] << 16 ) \ + ( (unsigned)_hj_key[7] << 24 ) ); \ hashv += (_hj_key[8] + ( (unsigned)_hj_key[9] << 8 ) \ + ( (unsigned)_hj_key[10] << 16 ) \ + ( (unsigned)_hj_key[11] << 24 ) ); \ \ HASH_JEN_MIX(_hj_i, _hj_j, hashv); \ \ _hj_key += 12; \ _hj_k -= 12U; \ } \ hashv += (unsigned)(keylen); \ switch ( _hj_k ) { \ case 11: hashv += ( (unsigned)_hj_key[10] << 24 ); /* FALLTHROUGH */ \ case 10: hashv += ( (unsigned)_hj_key[9] << 16 ); /* FALLTHROUGH */ \ case 9: hashv += ( (unsigned)_hj_key[8] << 8 ); /* FALLTHROUGH */ \ case 8: _hj_j += ( (unsigned)_hj_key[7] << 24 ); /* FALLTHROUGH */ \ case 7: _hj_j += ( (unsigned)_hj_key[6] << 16 ); /* FALLTHROUGH */ \ case 6: _hj_j += ( (unsigned)_hj_key[5] << 8 ); /* FALLTHROUGH */ \ case 5: _hj_j += _hj_key[4]; /* FALLTHROUGH */ \ case 4: _hj_i += ( (unsigned)_hj_key[3] << 24 ); /* FALLTHROUGH */ \ case 3: _hj_i += ( (unsigned)_hj_key[2] << 16 ); /* FALLTHROUGH */ \ case 2: _hj_i += ( (unsigned)_hj_key[1] << 8 ); /* FALLTHROUGH */ \ case 1: _hj_i += _hj_key[0]; \ } \ HASH_JEN_MIX(_hj_i, _hj_j, hashv); \ } while (0) /* The Paul Hsieh hash function */ #undef get16bits #if (defined(__GNUC__) && defined(__i386__)) || defined(__WATCOMC__) \ || defined(_MSC_VER) || defined (__BORLANDC__) || defined (__TURBOC__) #define get16bits(d) (*((const uint16_t *) (d))) #endif #if !defined (get16bits) #define get16bits(d) ((((uint32_t)(((const uint8_t *)(d))[1])) << 8) \ +(uint32_t)(((const uint8_t *)(d))[0]) ) #endif #define HASH_SFH(key,keylen,hashv) \ do { \ unsigned const char *_sfh_key=(unsigned const char*)(key); \ uint32_t _sfh_tmp, _sfh_len = (uint32_t)keylen; \ \ unsigned _sfh_rem = _sfh_len & 3U; \ _sfh_len >>= 2; \ hashv = 0xcafebabeu; \ \ /* Main loop */ \ for (;_sfh_len > 0U; _sfh_len--) { \ hashv += get16bits (_sfh_key); \ _sfh_tmp = ((uint32_t)(get16bits (_sfh_key+2)) << 11) ^ hashv; \ hashv = (hashv << 16) ^ _sfh_tmp; \ _sfh_key += 2U*sizeof (uint16_t); \ hashv += hashv >> 11; \ } \ \ /* Handle end cases */ \ switch (_sfh_rem) { \ case 3: hashv += get16bits (_sfh_key); \ hashv ^= hashv << 16; \ hashv ^= (uint32_t)(_sfh_key[sizeof (uint16_t)]) << 18; \ hashv += hashv >> 11; \ break; \ case 2: hashv += get16bits (_sfh_key); \ hashv ^= hashv << 11; \ hashv += hashv >> 17; \ break; \ case 1: hashv += *_sfh_key; \ hashv ^= hashv << 10; \ hashv += hashv >> 1; \ } \ \ /* Force "avalanching" of final 127 bits */ \ hashv ^= hashv << 3; \ hashv += hashv >> 5; \ hashv ^= hashv << 4; \ hashv += hashv >> 17; \ hashv ^= hashv << 25; \ hashv += hashv >> 6; \ } while (0) #ifdef HASH_USING_NO_STRICT_ALIASING /* The MurmurHash exploits some CPU's (x86,x86_64) tolerance for unaligned reads. * For other types of CPU's (e.g. Sparc) an unaligned read causes a bus error. * MurmurHash uses the faster approach only on CPU's where we know it's safe. * * Note the preprocessor built-in defines can be emitted using: * * gcc -m64 -dM -E - < /dev/null (on gcc) * cc -## a.c (where a.c is a simple test file) (Sun Studio) */ #if (defined(__i386__) || defined(__x86_64__) || defined(_M_IX86)) #define MUR_GETBLOCK(p,i) p[i] #else /* non intel */ #define MUR_PLUS0_ALIGNED(p) (((unsigned long)p & 3UL) == 0UL) #define MUR_PLUS1_ALIGNED(p) (((unsigned long)p & 3UL) == 1UL) #define MUR_PLUS2_ALIGNED(p) (((unsigned long)p & 3UL) == 2UL) #define MUR_PLUS3_ALIGNED(p) (((unsigned long)p & 3UL) == 3UL) #define WP(p) ((uint32_t*)((unsigned long)(p) & ~3UL)) #if (defined(__BIG_ENDIAN__) || defined(SPARC) || defined(__ppc__) || defined(__ppc64__)) #define MUR_THREE_ONE(p) ((((*WP(p))&0x00ffffff) << 8) | (((*(WP(p)+1))&0xff000000) >> 24)) #define MUR_TWO_TWO(p) ((((*WP(p))&0x0000ffff) <<16) | (((*(WP(p)+1))&0xffff0000) >> 16)) #define MUR_ONE_THREE(p) ((((*WP(p))&0x000000ff) <<24) | (((*(WP(p)+1))&0xffffff00) >> 8)) #else /* assume little endian non-intel */ #define MUR_THREE_ONE(p) ((((*WP(p))&0xffffff00) >> 8) | (((*(WP(p)+1))&0x000000ff) << 24)) #define MUR_TWO_TWO(p) ((((*WP(p))&0xffff0000) >>16) | (((*(WP(p)+1))&0x0000ffff) << 16)) #define MUR_ONE_THREE(p) ((((*WP(p))&0xff000000) >>24) | (((*(WP(p)+1))&0x00ffffff) << 8)) #endif #define MUR_GETBLOCK(p,i) (MUR_PLUS0_ALIGNED(p) ? ((p)[i]) : \ (MUR_PLUS1_ALIGNED(p) ? MUR_THREE_ONE(p) : \ (MUR_PLUS2_ALIGNED(p) ? MUR_TWO_TWO(p) : \ MUR_ONE_THREE(p)))) #endif #define MUR_ROTL32(x,r) (((x) << (r)) | ((x) >> (32 - (r)))) #define MUR_FMIX(_h) \ do { \ _h ^= _h >> 16; \ _h *= 0x85ebca6bu; \ _h ^= _h >> 13; \ _h *= 0xc2b2ae35u; \ _h ^= _h >> 16; \ } while (0) #define HASH_MUR(key,keylen,hashv) \ do { \ const uint8_t *_mur_data = (const uint8_t*)(key); \ const int _mur_nblocks = (int)(keylen) / 4; \ uint32_t _mur_h1 = 0xf88D5353u; \ uint32_t _mur_c1 = 0xcc9e2d51u; \ uint32_t _mur_c2 = 0x1b873593u; \ uint32_t _mur_k1 = 0; \ const uint8_t *_mur_tail; \ const uint32_t *_mur_blocks = (const uint32_t*)(_mur_data+(_mur_nblocks*4)); \ int _mur_i; \ for(_mur_i = -_mur_nblocks; _mur_i!=0; _mur_i++) { \ _mur_k1 = MUR_GETBLOCK(_mur_blocks,_mur_i); \ _mur_k1 *= _mur_c1; \ _mur_k1 = MUR_ROTL32(_mur_k1,15); \ _mur_k1 *= _mur_c2; \ \ _mur_h1 ^= _mur_k1; \ _mur_h1 = MUR_ROTL32(_mur_h1,13); \ _mur_h1 = (_mur_h1*5U) + 0xe6546b64u; \ } \ _mur_tail = (const uint8_t*)(_mur_data + (_mur_nblocks*4)); \ _mur_k1=0; \ switch((keylen) & 3U) { \ case 3: _mur_k1 ^= (uint32_t)_mur_tail[2] << 16; /* FALLTHROUGH */ \ case 2: _mur_k1 ^= (uint32_t)_mur_tail[1] << 8; /* FALLTHROUGH */ \ case 1: _mur_k1 ^= (uint32_t)_mur_tail[0]; \ _mur_k1 *= _mur_c1; \ _mur_k1 = MUR_ROTL32(_mur_k1,15); \ _mur_k1 *= _mur_c2; \ _mur_h1 ^= _mur_k1; \ } \ _mur_h1 ^= (uint32_t)(keylen); \ MUR_FMIX(_mur_h1); \ hashv = _mur_h1; \ } while (0) #endif /* HASH_USING_NO_STRICT_ALIASING */ /* iterate over items in a known bucket to find desired item */ #define HASH_FIND_IN_BKT(tbl,hh,head,keyptr,keylen_in,hashval,out) \ do { \ if ((head).hh_head != NULL) { \ DECLTYPE_ASSIGN(out, ELMT_FROM_HH(tbl, (head).hh_head)); \ } else { \ (out) = NULL; \ } \ while ((out) != NULL) { \ if ((out)->hh.hashv == (hashval) && (out)->hh.keylen == (keylen_in)) { \ if (uthash_memcmp((out)->hh.key, keyptr, keylen_in) == 0) { \ break; \ } \ } \ if ((out)->hh.hh_next != NULL) { \ DECLTYPE_ASSIGN(out, ELMT_FROM_HH(tbl, (out)->hh.hh_next)); \ } else { \ (out) = NULL; \ } \ } \ } while (0) /* add an item to a bucket */ #define HASH_ADD_TO_BKT(head,addhh) \ do { \ head.count++; \ (addhh)->hh_next = head.hh_head; \ (addhh)->hh_prev = NULL; \ if (head.hh_head != NULL) { (head).hh_head->hh_prev = (addhh); } \ (head).hh_head=addhh; \ if ((head.count >= ((head.expand_mult+1U) * HASH_BKT_CAPACITY_THRESH)) \ && ((addhh)->tbl->noexpand != 1U)) { \ HASH_EXPAND_BUCKETS((addhh)->tbl); \ } \ } while (0) /* remove an item from a given bucket */ #define HASH_DEL_IN_BKT(hh,head,hh_del) \ (head).count--; \ if ((head).hh_head == hh_del) { \ (head).hh_head = hh_del->hh_next; \ } \ if (hh_del->hh_prev) { \ hh_del->hh_prev->hh_next = hh_del->hh_next; \ } \ if (hh_del->hh_next) { \ hh_del->hh_next->hh_prev = hh_del->hh_prev; \ } /* Bucket expansion has the effect of doubling the number of buckets * and redistributing the items into the new buckets. Ideally the * items will distribute more or less evenly into the new buckets * (the extent to which this is true is a measure of the quality of * the hash function as it applies to the key domain). * * With the items distributed into more buckets, the chain length * (item count) in each bucket is reduced. Thus by expanding buckets * the hash keeps a bound on the chain length. This bounded chain * length is the essence of how a hash provides constant time lookup. * * The calculation of tbl->ideal_chain_maxlen below deserves some * explanation. First, keep in mind that we're calculating the ideal * maximum chain length based on the *new* (doubled) bucket count. * In fractions this is just n/b (n=number of items,b=new num buckets). * Since the ideal chain length is an integer, we want to calculate * ceil(n/b). We don't depend on floating point arithmetic in this * hash, so to calculate ceil(n/b) with integers we could write * * ceil(n/b) = (n/b) + ((n%b)?1:0) * * and in fact a previous version of this hash did just that. * But now we have improved things a bit by recognizing that b is * always a power of two. We keep its base 2 log handy (call it lb), * so now we can write this with a bit shift and logical AND: * * ceil(n/b) = (n>>lb) + ( (n & (b-1)) ? 1:0) * */ #define HASH_EXPAND_BUCKETS(tbl) \ do { \ unsigned _he_bkt; \ unsigned _he_bkt_i; \ struct UT_hash_handle *_he_thh, *_he_hh_nxt; \ UT_hash_bucket *_he_new_buckets, *_he_newbkt; \ _he_new_buckets = (UT_hash_bucket*)uthash_malloc( \ 2UL * tbl->num_buckets * sizeof(struct UT_hash_bucket)); \ if (!_he_new_buckets) { uthash_fatal( "out of memory"); } \ memset(_he_new_buckets, 0, \ 2UL * tbl->num_buckets * sizeof(struct UT_hash_bucket)); \ tbl->ideal_chain_maxlen = \ (tbl->num_items >> (tbl->log2_num_buckets+1U)) + \ (((tbl->num_items & ((tbl->num_buckets*2U)-1U)) != 0U) ? 1U : 0U); \ tbl->nonideal_items = 0; \ for(_he_bkt_i = 0; _he_bkt_i < tbl->num_buckets; _he_bkt_i++) \ { \ _he_thh = tbl->buckets[ _he_bkt_i ].hh_head; \ while (_he_thh != NULL) { \ _he_hh_nxt = _he_thh->hh_next; \ HASH_TO_BKT( _he_thh->hashv, tbl->num_buckets*2U, _he_bkt); \ _he_newbkt = &(_he_new_buckets[ _he_bkt ]); \ if (++(_he_newbkt->count) > tbl->ideal_chain_maxlen) { \ tbl->nonideal_items++; \ _he_newbkt->expand_mult = _he_newbkt->count / \ tbl->ideal_chain_maxlen; \ } \ _he_thh->hh_prev = NULL; \ _he_thh->hh_next = _he_newbkt->hh_head; \ if (_he_newbkt->hh_head != NULL) { _he_newbkt->hh_head->hh_prev = \ _he_thh; } \ _he_newbkt->hh_head = _he_thh; \ _he_thh = _he_hh_nxt; \ } \ } \ uthash_free( tbl->buckets, tbl->num_buckets*sizeof(struct UT_hash_bucket) ); \ tbl->num_buckets *= 2U; \ tbl->log2_num_buckets++; \ tbl->buckets = _he_new_buckets; \ tbl->ineff_expands = (tbl->nonideal_items > (tbl->num_items >> 1)) ? \ (tbl->ineff_expands+1U) : 0U; \ if (tbl->ineff_expands > 1U) { \ tbl->noexpand=1; \ uthash_noexpand_fyi(tbl); \ } \ uthash_expand_fyi(tbl); \ } while (0) /* This is an adaptation of Simon Tatham's O(n log(n)) mergesort */ /* Note that HASH_SORT assumes the hash handle name to be hh. * HASH_SRT was added to allow the hash handle name to be passed in. */ #define HASH_SORT(head,cmpfcn) HASH_SRT(hh,head,cmpfcn) #define HASH_SRT(hh,head,cmpfcn) \ do { \ unsigned _hs_i; \ unsigned _hs_looping,_hs_nmerges,_hs_insize,_hs_psize,_hs_qsize; \ struct UT_hash_handle *_hs_p, *_hs_q, *_hs_e, *_hs_list, *_hs_tail; \ if (head != NULL) { \ _hs_insize = 1; \ _hs_looping = 1; \ _hs_list = &((head)->hh); \ while (_hs_looping != 0U) { \ _hs_p = _hs_list; \ _hs_list = NULL; \ _hs_tail = NULL; \ _hs_nmerges = 0; \ while (_hs_p != NULL) { \ _hs_nmerges++; \ _hs_q = _hs_p; \ _hs_psize = 0; \ for ( _hs_i = 0; _hs_i < _hs_insize; _hs_i++ ) { \ _hs_psize++; \ _hs_q = (UT_hash_handle*)((_hs_q->next != NULL) ? \ ((void*)((char*)(_hs_q->next) + \ (head)->hh.tbl->hho)) : NULL); \ if (! (_hs_q) ) { break; } \ } \ _hs_qsize = _hs_insize; \ while ((_hs_psize > 0U) || ((_hs_qsize > 0U) && (_hs_q != NULL))) {\ if (_hs_psize == 0U) { \ _hs_e = _hs_q; \ _hs_q = (UT_hash_handle*)((_hs_q->next != NULL) ? \ ((void*)((char*)(_hs_q->next) + \ (head)->hh.tbl->hho)) : NULL); \ _hs_qsize--; \ } else if ( (_hs_qsize == 0U) || (_hs_q == NULL) ) { \ _hs_e = _hs_p; \ if (_hs_p != NULL){ \ _hs_p = (UT_hash_handle*)((_hs_p->next != NULL) ? \ ((void*)((char*)(_hs_p->next) + \ (head)->hh.tbl->hho)) : NULL); \ } \ _hs_psize--; \ } else if (( \ cmpfcn(DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl,_hs_p)), \ DECLTYPE(head)(ELMT_FROM_HH((head)->hh.tbl,_hs_q))) \ ) <= 0) { \ _hs_e = _hs_p; \ if (_hs_p != NULL){ \ _hs_p = (UT_hash_handle*)((_hs_p->next != NULL) ? \ ((void*)((char*)(_hs_p->next) + \ (head)->hh.tbl->hho)) : NULL); \ } \ _hs_psize--; \ } else { \ _hs_e = _hs_q; \ _hs_q = (UT_hash_handle*)((_hs_q->next != NULL) ? \ ((void*)((char*)(_hs_q->next) + \ (head)->hh.tbl->hho)) : NULL); \ _hs_qsize--; \ } \ if ( _hs_tail != NULL ) { \ _hs_tail->next = ((_hs_e != NULL) ? \ ELMT_FROM_HH((head)->hh.tbl,_hs_e) : NULL); \ } else { \ _hs_list = _hs_e; \ } \ if (_hs_e != NULL) { \ _hs_e->prev = ((_hs_tail != NULL) ? \ ELMT_FROM_HH((head)->hh.tbl,_hs_tail) : NULL); \ } \ _hs_tail = _hs_e; \ } \ _hs_p = _hs_q; \ } \ if (_hs_tail != NULL){ \ _hs_tail->next = NULL; \ } \ if ( _hs_nmerges <= 1U ) { \ _hs_looping=0; \ (head)->hh.tbl->tail = _hs_tail; \ DECLTYPE_ASSIGN(head,ELMT_FROM_HH((head)->hh.tbl, _hs_list)); \ } \ _hs_insize *= 2U; \ } \ HASH_FSCK(hh,head); \ } \ } while (0) /* This function selects items from one hash into another hash. * The end result is that the selected items have dual presence * in both hashes. There is no copy of the items made; rather * they are added into the new hash through a secondary hash * hash handle that must be present in the structure. */ #define HASH_SELECT(hh_dst, dst, hh_src, src, cond) \ do { \ unsigned _src_bkt, _dst_bkt; \ void *_last_elt=NULL, *_elt; \ UT_hash_handle *_src_hh, *_dst_hh, *_last_elt_hh=NULL; \ ptrdiff_t _dst_hho = ((char*)(&(dst)->hh_dst) - (char*)(dst)); \ if (src != NULL) { \ for(_src_bkt=0; _src_bkt < (src)->hh_src.tbl->num_buckets; _src_bkt++) { \ for(_src_hh = (src)->hh_src.tbl->buckets[_src_bkt].hh_head; \ _src_hh != NULL; \ _src_hh = _src_hh->hh_next) { \ _elt = ELMT_FROM_HH((src)->hh_src.tbl, _src_hh); \ if (cond(_elt)) { \ _dst_hh = (UT_hash_handle*)(((char*)_elt) + _dst_hho); \ _dst_hh->key = _src_hh->key; \ _dst_hh->keylen = _src_hh->keylen; \ _dst_hh->hashv = _src_hh->hashv; \ _dst_hh->prev = _last_elt; \ _dst_hh->next = NULL; \ if (_last_elt_hh != NULL) { _last_elt_hh->next = _elt; } \ if (dst == NULL) { \ DECLTYPE_ASSIGN(dst,_elt); \ HASH_MAKE_TABLE(hh_dst,dst); \ } else { \ _dst_hh->tbl = (dst)->hh_dst.tbl; \ } \ HASH_TO_BKT(_dst_hh->hashv, _dst_hh->tbl->num_buckets, _dst_bkt); \ HASH_ADD_TO_BKT(_dst_hh->tbl->buckets[_dst_bkt],_dst_hh); \ (dst)->hh_dst.tbl->num_items++; \ _last_elt = _elt; \ _last_elt_hh = _dst_hh; \ } \ } \ } \ } \ HASH_FSCK(hh_dst,dst); \ } while (0) #define HASH_CLEAR(hh,head) \ do { \ if (head != NULL) { \ uthash_free((head)->hh.tbl->buckets, \ (head)->hh.tbl->num_buckets*sizeof(struct UT_hash_bucket)); \ HASH_BLOOM_FREE((head)->hh.tbl); \ uthash_free((head)->hh.tbl, sizeof(UT_hash_table)); \ (head)=NULL; \ } \ } while (0) #define HASH_OVERHEAD(hh,head) \ ((head != NULL) ? ( \ (size_t)(((head)->hh.tbl->num_items * sizeof(UT_hash_handle)) + \ ((head)->hh.tbl->num_buckets * sizeof(UT_hash_bucket)) + \ sizeof(UT_hash_table) + \ (HASH_BLOOM_BYTELEN))) : 0U) #ifdef NO_DECLTYPE #define HASH_ITER(hh,head,el,tmp) \ for(((el)=(head)), ((*(char**)(&(tmp)))=(char*)((head!=NULL)?(head)->hh.next:NULL)); \ (el) != NULL; ((el)=(tmp)), ((*(char**)(&(tmp)))=(char*)((tmp!=NULL)?(tmp)->hh.next:NULL))) #else #define HASH_ITER(hh,head,el,tmp) \ for(((el)=(head)), ((tmp)=DECLTYPE(el)((head!=NULL)?(head)->hh.next:NULL)); \ (el) != NULL; ((el)=(tmp)), ((tmp)=DECLTYPE(el)((tmp!=NULL)?(tmp)->hh.next:NULL))) #endif /* obtain a count of items in the hash */ #define HASH_COUNT(head) HASH_CNT(hh,head) #define HASH_CNT(hh,head) ((head != NULL)?((head)->hh.tbl->num_items):0U) typedef struct UT_hash_bucket { struct UT_hash_handle *hh_head; unsigned count; /* expand_mult is normally set to 0. In this situation, the max chain length * threshold is enforced at its default value, HASH_BKT_CAPACITY_THRESH. (If * the bucket's chain exceeds this length, bucket expansion is triggered). * However, setting expand_mult to a non-zero value delays bucket expansion * (that would be triggered by additions to this particular bucket) * until its chain length reaches a *multiple* of HASH_BKT_CAPACITY_THRESH. * (The multiplier is simply expand_mult+1). The whole idea of this * multiplier is to reduce bucket expansions, since they are expensive, in * situations where we know that a particular bucket tends to be overused. * It is better to let its chain length grow to a longer yet-still-bounded * value, than to do an O(n) bucket expansion too often. */ unsigned expand_mult; } UT_hash_bucket; /* random signature used only to find hash tables in external analysis */ #define HASH_SIGNATURE 0xa0111fe1u #define HASH_BLOOM_SIGNATURE 0xb12220f2u typedef struct UT_hash_table { UT_hash_bucket *buckets; unsigned num_buckets, log2_num_buckets; unsigned num_items; struct UT_hash_handle *tail; /* tail hh in app order, for fast append */ ptrdiff_t hho; /* hash handle offset (byte pos of hash handle in element */ /* in an ideal situation (all buckets used equally), no bucket would have * more than ceil(#items/#buckets) items. that's the ideal chain length. */ unsigned ideal_chain_maxlen; /* nonideal_items is the number of items in the hash whose chain position * exceeds the ideal chain maxlen. these items pay the penalty for an uneven * hash distribution; reaching them in a chain traversal takes >ideal steps */ unsigned nonideal_items; /* ineffective expands occur when a bucket doubling was performed, but * afterward, more than half the items in the hash had nonideal chain * positions. If this happens on two consecutive expansions we inhibit any * further expansion, as it's not helping; this happens when the hash * function isn't a good fit for the key domain. When expansion is inhibited * the hash will still work, albeit no longer in constant time. */ unsigned ineff_expands, noexpand; uint32_t signature; /* used only to find hash tables in external analysis */ #ifdef HASH_BLOOM uint32_t bloom_sig; /* used only to test bloom exists in external analysis */ uint8_t *bloom_bv; uint8_t bloom_nbits; #endif } UT_hash_table; typedef struct UT_hash_handle { struct UT_hash_table *tbl; void *prev; /* prev element in app order */ void *next; /* next element in app order */ struct UT_hash_handle *hh_prev; /* previous hh in bucket order */ struct UT_hash_handle *hh_next; /* next hh in bucket order */ void *key; /* ptr to enclosing struct's key */ unsigned keylen; /* enclosing struct's key len */ unsigned hashv; /* result of hash-fcn(key) */ } UT_hash_handle; #endif /* UTHASH_H */ nDPI-2.2/lib000077700000000000000000000000001321103654100151162src/lib/.libsustar00rootroot00000000000000nDPI-2.2/libndpi.pc.in000066400000000000000000000003431321103654100145150ustar00rootroot00000000000000prefix=@prefix@ exec_prefix=@exec_prefix@ libdir=@libdir@ includedir=@includedir@ Name: libndpi Description: deep packet inspection library Version: @VERSION@ Libs: -L${libdir} -lndpi Cflags: -I${includedir}/libndpi-@VERSION@ nDPI-2.2/libndpi.sym000066400000000000000000000025171321103654100143230ustar00rootroot00000000000000ndpi_dump_protocols ndpi_strnstr ndpi_detection_giveup ndpi_get_proto_name ndpi_free ndpi_flow_free ndpi_guess_undetected_protocol ndpi_tfind ndpi_tsearch ndpi_set_protocol_detection_bitmask2 ndpi_detection_get_sizeof_ndpi_id_struct ndpi_detection_get_sizeof_ndpi_flow_struct ndpi_load_protocols_file ndpi_tdestroy ndpi_exit_detection_module ndpi_l4_detection_process_packet ndpi_detection_process_packet ndpi_twalk ndpi_tdelete ndpi_revision ndpi_init_detection_module ndpi_get_num_supported_protocols ndpi_set_proto_defaults ndpi_get_protocol_id ndpi_find_port_based_protocol ndpi_get_http_method ndpi_get_http_url ndpi_get_http_content_type ndpi_free_flow ndpi_get_proto_breed ndpi_get_proto_breed_name ndpi_get_proto_by_id ndpi_get_proto_by_name ndpi_get_protocol_id_master_proto ndpi_guess_protocol_id ndpi_protocol2name ndpi_get_lower_proto ndpi_is_proto ndpi_malloc ndpi_calloc ndpi_set_detected_protocol ndpi_match_string_subprotocol ndpi_init_automa ndpi_free_automa ndpi_add_string_value_to_automa ndpi_add_string_to_automa ndpi_finalize_automa ndpi_match_string ndpi_match_string_id set_ndpi_malloc set_ndpi_flow_malloc set_ndpi_free set_ndpi_flow_free set_ndpi_debug_function ndpi_category_str ndpi_get_proto_category ndpi_netbios_name_interpret ndpi_category_set_name ndpi_category_get_name ndpi_is_custom_category ndpi_is_subprotocol_informativenDPI-2.2/m4/000077500000000000000000000000001321103654100124635ustar00rootroot00000000000000nDPI-2.2/m4/ax_pthread.m4000066400000000000000000000505201321103654100150460ustar00rootroot00000000000000# =========================================================================== # http://www.gnu.org/software/autoconf-archive/ax_pthread.html # =========================================================================== # # SYNOPSIS # # AX_PTHREAD([ACTION-IF-FOUND[, ACTION-IF-NOT-FOUND]]) # # DESCRIPTION # # This macro figures out how to build C programs using POSIX threads. It # sets the PTHREAD_LIBS output variable to the threads library and linker # flags, and the PTHREAD_CFLAGS output variable to any special C compiler # flags that are needed. (The user can also force certain compiler # flags/libs to be tested by setting these environment variables.) # # Also sets PTHREAD_CC to any special C compiler that is needed for # multi-threaded programs (defaults to the value of CC otherwise). (This # is necessary on AIX to use the special cc_r compiler alias.) # # NOTE: You are assumed to not only compile your program with these flags, # but also to link with them as well. For example, you might link with # $PTHREAD_CC $CFLAGS $PTHREAD_CFLAGS $LDFLAGS ... $PTHREAD_LIBS $LIBS # # If you are only building threaded programs, you may wish to use these # variables in your default LIBS, CFLAGS, and CC: # # LIBS="$PTHREAD_LIBS $LIBS" # CFLAGS="$CFLAGS $PTHREAD_CFLAGS" # CC="$PTHREAD_CC" # # In addition, if the PTHREAD_CREATE_JOINABLE thread-attribute constant # has a nonstandard name, this macro defines PTHREAD_CREATE_JOINABLE to # that name (e.g. PTHREAD_CREATE_UNDETACHED on AIX). # # Also HAVE_PTHREAD_PRIO_INHERIT is defined if pthread is found and the # PTHREAD_PRIO_INHERIT symbol is defined when compiling with # PTHREAD_CFLAGS. # # ACTION-IF-FOUND is a list of shell commands to run if a threads library # is found, and ACTION-IF-NOT-FOUND is a list of commands to run it if it # is not found. If ACTION-IF-FOUND is not specified, the default action # will define HAVE_PTHREAD. # # Please let the authors know if this macro fails on any platform, or if # you have any other suggestions or comments. This macro was based on work # by SGJ on autoconf scripts for FFTW (http://www.fftw.org/) (with help # from M. Frigo), as well as ac_pthread and hb_pthread macros posted by # Alejandro Forero Cuervo to the autoconf macro repository. We are also # grateful for the helpful feedback of numerous users. # # Updated for Autoconf 2.68 by Daniel Richard G. # # LICENSE # # Copyright (c) 2008 Steven G. Johnson # Copyright (c) 2011 Daniel Richard G. # # This program is free software: you can redistribute it and/or modify it # under the terms of the GNU General Public License as published by the # Free Software Foundation, either version 3 of the License, or (at your # option) any later version. # # This program is distributed in the hope that it will be useful, but # WITHOUT ANY WARRANTY; without even the implied warranty of # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General # Public License for more details. # # You should have received a copy of the GNU General Public License along # with this program. If not, see . # # As a special exception, the respective Autoconf Macro's copyright owner # gives unlimited permission to copy, distribute and modify the configure # scripts that are the output of Autoconf when processing the Macro. You # need not follow the terms of the GNU General Public License when using # or distributing such scripts, even though portions of the text of the # Macro appear in them. The GNU General Public License (GPL) does govern # all other use of the material that constitutes the Autoconf Macro. # # This special exception to the GPL applies to versions of the Autoconf # Macro released by the Autoconf Archive. When you make and distribute a # modified version of the Autoconf Macro, you may extend this special # exception to the GPL to apply to your modified version as well. #serial 23 AU_ALIAS([ACX_PTHREAD], [AX_PTHREAD]) AC_DEFUN([AX_PTHREAD], [ AC_REQUIRE([AC_CANONICAL_HOST]) AC_REQUIRE([AC_PROG_CC]) AC_REQUIRE([AC_PROG_SED]) AC_LANG_PUSH([C]) ax_pthread_ok=no # We used to check for pthread.h first, but this fails if pthread.h # requires special compiler flags (e.g. on Tru64 or Sequent). # It gets checked for in the link test anyway. # First of all, check if the user has set any of the PTHREAD_LIBS, # etcetera environment variables, and if threads linking works using # them: if test "x$PTHREAD_CFLAGS$PTHREAD_LIBS" != "x"; then ax_pthread_save_CC="$CC" ax_pthread_save_CFLAGS="$CFLAGS" ax_pthread_save_LIBS="$LIBS" AS_IF([test "x$PTHREAD_CC" != "x"], [CC="$PTHREAD_CC"]) CFLAGS="$CFLAGS $PTHREAD_CFLAGS" LIBS="$PTHREAD_LIBS $LIBS" AC_MSG_CHECKING([for pthread_join using $CC $PTHREAD_CFLAGS $PTHREAD_LIBS]) AC_LINK_IFELSE([AC_LANG_CALL([], [pthread_join])], [ax_pthread_ok=yes]) AC_MSG_RESULT([$ax_pthread_ok]) if test "x$ax_pthread_ok" = "xno"; then PTHREAD_LIBS="" PTHREAD_CFLAGS="" fi CC="$ax_pthread_save_CC" CFLAGS="$ax_pthread_save_CFLAGS" LIBS="$ax_pthread_save_LIBS" fi # We must check for the threads library under a number of different # names; the ordering is very important because some systems # (e.g. DEC) have both -lpthread and -lpthreads, where one of the # libraries is broken (non-POSIX). # Create a list of thread flags to try. Items starting with a "-" are # C compiler flags, and other items are library names, except for "none" # which indicates that we try without any flags at all, and "pthread-config" # which is a program returning the flags for the Pth emulation library. ax_pthread_flags="pthreads none -Kthread -pthread -pthreads -mthreads pthread --thread-safe -mt pthread-config" # The ordering *is* (sometimes) important. Some notes on the # individual items follow: # pthreads: AIX (must check this before -lpthread) # none: in case threads are in libc; should be tried before -Kthread and # other compiler flags to prevent continual compiler warnings # -Kthread: Sequent (threads in libc, but -Kthread needed for pthread.h) # -pthread: Linux/gcc (kernel threads), BSD/gcc (userland threads), Tru64 # (Note: HP C rejects this with "bad form for `-t' option") # -pthreads: Solaris/gcc (Note: HP C also rejects) # -mt: Sun Workshop C (may only link SunOS threads [-lthread], but it # doesn't hurt to check since this sometimes defines pthreads and # -D_REENTRANT too), HP C (must be checked before -lpthread, which # is present but should not be used directly; and before -mthreads, # because the compiler interprets this as "-mt" + "-hreads") # -mthreads: Mingw32/gcc, Lynx/gcc # pthread: Linux, etcetera # --thread-safe: KAI C++ # pthread-config: use pthread-config program (for GNU Pth library) case $host_os in freebsd*) # -kthread: FreeBSD kernel threads (preferred to -pthread since SMP-able) # lthread: LinuxThreads port on FreeBSD (also preferred to -pthread) ax_pthread_flags="-kthread lthread $ax_pthread_flags" ;; hpux*) # From the cc(1) man page: "[-mt] Sets various -D flags to enable # multi-threading and also sets -lpthread." ax_pthread_flags="-mt -pthread pthread $ax_pthread_flags" ;; openedition*) # IBM z/OS requires a feature-test macro to be defined in order to # enable POSIX threads at all, so give the user a hint if this is # not set. (We don't define these ourselves, as they can affect # other portions of the system API in unpredictable ways.) AC_EGREP_CPP([AX_PTHREAD_ZOS_MISSING], [ # if !defined(_OPEN_THREADS) && !defined(_UNIX03_THREADS) AX_PTHREAD_ZOS_MISSING # endif ], [AC_MSG_WARN([IBM z/OS requires -D_OPEN_THREADS or -D_UNIX03_THREADS to enable pthreads support.])]) ;; solaris*) # On Solaris (at least, for some versions), libc contains stubbed # (non-functional) versions of the pthreads routines, so link-based # tests will erroneously succeed. (N.B.: The stubs are missing # pthread_cleanup_push, or rather a function called by this macro, # so we could check for that, but who knows whether they'll stub # that too in a future libc.) So we'll check first for the # standard Solaris way of linking pthreads (-mt -lpthread). ax_pthread_flags="-mt,pthread pthread $ax_pthread_flags" ;; esac # GCC generally uses -pthread, or -pthreads on some platforms (e.g. SPARC) AS_IF([test "x$GCC" = "xyes"], [ax_pthread_flags="-pthread -pthreads $ax_pthread_flags"]) # The presence of a feature test macro requesting re-entrant function # definitions is, on some systems, a strong hint that pthreads support is # correctly enabled case $host_os in darwin* | hpux* | linux* | osf* | solaris*) ax_pthread_check_macro="_REENTRANT" ;; aix*) ax_pthread_check_macro="_THREAD_SAFE" ;; *) ax_pthread_check_macro="--" ;; esac AS_IF([test "x$ax_pthread_check_macro" = "x--"], [ax_pthread_check_cond=0], [ax_pthread_check_cond="!defined($ax_pthread_check_macro)"]) # Are we compiling with Clang? AC_CACHE_CHECK([whether $CC is Clang], [ax_cv_PTHREAD_CLANG], [ax_cv_PTHREAD_CLANG=no # Note that Autoconf sets GCC=yes for Clang as well as GCC if test "x$GCC" = "xyes"; then AC_EGREP_CPP([AX_PTHREAD_CC_IS_CLANG], [/* Note: Clang 2.7 lacks __clang_[a-z]+__ */ # if defined(__clang__) && defined(__llvm__) AX_PTHREAD_CC_IS_CLANG # endif ], [ax_cv_PTHREAD_CLANG=yes]) fi ]) ax_pthread_clang="$ax_cv_PTHREAD_CLANG" ax_pthread_clang_warning=no # Clang needs special handling, because older versions handle the -pthread # option in a rather... idiosyncratic way if test "x$ax_pthread_clang" = "xyes"; then # Clang takes -pthread; it has never supported any other flag # (Note 1: This will need to be revisited if a system that Clang # supports has POSIX threads in a separate library. This tends not # to be the way of modern systems, but it's conceivable.) # (Note 2: On some systems, notably Darwin, -pthread is not needed # to get POSIX threads support; the API is always present and # active. We could reasonably leave PTHREAD_CFLAGS empty. But # -pthread does define _REENTRANT, and while the Darwin headers # ignore this macro, third-party headers might not.) PTHREAD_CFLAGS="-pthread" PTHREAD_LIBS= ax_pthread_ok=yes # However, older versions of Clang make a point of warning the user # that, in an invocation where only linking and no compilation is # taking place, the -pthread option has no effect ("argument unused # during compilation"). They expect -pthread to be passed in only # when source code is being compiled. # # Problem is, this is at odds with the way Automake and most other # C build frameworks function, which is that the same flags used in # compilation (CFLAGS) are also used in linking. Many systems # supported by AX_PTHREAD require exactly this for POSIX threads # support, and in fact it is often not straightforward to specify a # flag that is used only in the compilation phase and not in # linking. Such a scenario is extremely rare in practice. # # Even though use of the -pthread flag in linking would only print # a warning, this can be a nuisance for well-run software projects # that build with -Werror. So if the active version of Clang has # this misfeature, we search for an option to squash it. AC_CACHE_CHECK([whether Clang needs flag to prevent "argument unused" warning when linking with -pthread], [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG], [ax_cv_PTHREAD_CLANG_NO_WARN_FLAG=unknown # Create an alternate version of $ac_link that compiles and # links in two steps (.c -> .o, .o -> exe) instead of one # (.c -> exe), because the warning occurs only in the second # step ax_pthread_save_ac_link="$ac_link" ax_pthread_sed='s/conftest\.\$ac_ext/conftest.$ac_objext/g' ax_pthread_link_step=`$as_echo "$ac_link" | sed "$ax_pthread_sed"` ax_pthread_2step_ac_link="($ac_compile) && (echo ==== >&5) && ($ax_pthread_link_step)" ax_pthread_save_CFLAGS="$CFLAGS" for ax_pthread_try in '' -Qunused-arguments -Wno-unused-command-line-argument unknown; do AS_IF([test "x$ax_pthread_try" = "xunknown"], [break]) CFLAGS="-Werror -Wunknown-warning-option $ax_pthread_try -pthread $ax_pthread_save_CFLAGS" ac_link="$ax_pthread_save_ac_link" AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])], [ac_link="$ax_pthread_2step_ac_link" AC_LINK_IFELSE([AC_LANG_SOURCE([[int main(void){return 0;}]])], [break]) ]) done ac_link="$ax_pthread_save_ac_link" CFLAGS="$ax_pthread_save_CFLAGS" AS_IF([test "x$ax_pthread_try" = "x"], [ax_pthread_try=no]) ax_cv_PTHREAD_CLANG_NO_WARN_FLAG="$ax_pthread_try" ]) case "$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG" in no | unknown) ;; *) PTHREAD_CFLAGS="$ax_cv_PTHREAD_CLANG_NO_WARN_FLAG $PTHREAD_CFLAGS" ;; esac fi # $ax_pthread_clang = yes if test "x$ax_pthread_ok" = "xno"; then for ax_pthread_try_flag in $ax_pthread_flags; do case $ax_pthread_try_flag in none) AC_MSG_CHECKING([whether pthreads work without any flags]) ;; -mt,pthread) AC_MSG_CHECKING([whether pthreads work with -mt -lpthread]) PTHREAD_CFLAGS="-mt" PTHREAD_LIBS="-lpthread" ;; -*) AC_MSG_CHECKING([whether pthreads work with $ax_pthread_try_flag]) PTHREAD_CFLAGS="$ax_pthread_try_flag" ;; pthread-config) AC_CHECK_PROG([ax_pthread_config], [pthread-config], [yes], [no]) AS_IF([test "x$ax_pthread_config" = "xno"], [continue]) PTHREAD_CFLAGS="`pthread-config --cflags`" PTHREAD_LIBS="`pthread-config --ldflags` `pthread-config --libs`" ;; *) AC_MSG_CHECKING([for the pthreads library -l$ax_pthread_try_flag]) PTHREAD_LIBS="-l$ax_pthread_try_flag" ;; esac ax_pthread_save_CFLAGS="$CFLAGS" ax_pthread_save_LIBS="$LIBS" CFLAGS="$CFLAGS $PTHREAD_CFLAGS" LIBS="$PTHREAD_LIBS $LIBS" # Check for various functions. We must include pthread.h, # since some functions may be macros. (On the Sequent, we # need a special flag -Kthread to make this header compile.) # We check for pthread_join because it is in -lpthread on IRIX # while pthread_create is in libc. We check for pthread_attr_init # due to DEC craziness with -lpthreads. We check for # pthread_cleanup_push because it is one of the few pthread # functions on Solaris that doesn't have a non-functional libc stub. # We try pthread_create on general principles. AC_LINK_IFELSE([AC_LANG_PROGRAM([#include # if $ax_pthread_check_cond # error "$ax_pthread_check_macro must be defined" # endif static void routine(void *a) { a = 0; } static void *start_routine(void *a) { return a; }], [pthread_t th; pthread_attr_t attr; pthread_create(&th, 0, start_routine, 0); pthread_join(th, 0); pthread_attr_init(&attr); pthread_cleanup_push(routine, 0); pthread_cleanup_pop(0) /* ; */])], [ax_pthread_ok=yes], []) CFLAGS="$ax_pthread_save_CFLAGS" LIBS="$ax_pthread_save_LIBS" AC_MSG_RESULT([$ax_pthread_ok]) AS_IF([test "x$ax_pthread_ok" = "xyes"], [break]) PTHREAD_LIBS="" PTHREAD_CFLAGS="" done fi # Various other checks: if test "x$ax_pthread_ok" = "xyes"; then ax_pthread_save_CFLAGS="$CFLAGS" ax_pthread_save_LIBS="$LIBS" CFLAGS="$CFLAGS $PTHREAD_CFLAGS" LIBS="$PTHREAD_LIBS $LIBS" # Detect AIX lossage: JOINABLE attribute is called UNDETACHED. AC_CACHE_CHECK([for joinable pthread attribute], [ax_cv_PTHREAD_JOINABLE_ATTR], [ax_cv_PTHREAD_JOINABLE_ATTR=unknown for ax_pthread_attr in PTHREAD_CREATE_JOINABLE PTHREAD_CREATE_UNDETACHED; do AC_LINK_IFELSE([AC_LANG_PROGRAM([#include ], [int attr = $ax_pthread_attr; return attr /* ; */])], [ax_cv_PTHREAD_JOINABLE_ATTR=$ax_pthread_attr; break], []) done ]) AS_IF([test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xunknown" && \ test "x$ax_cv_PTHREAD_JOINABLE_ATTR" != "xPTHREAD_CREATE_JOINABLE" && \ test "x$ax_pthread_joinable_attr_defined" != "xyes"], [AC_DEFINE_UNQUOTED([PTHREAD_CREATE_JOINABLE], [$ax_cv_PTHREAD_JOINABLE_ATTR], [Define to necessary symbol if this constant uses a non-standard name on your system.]) ax_pthread_joinable_attr_defined=yes ]) AC_CACHE_CHECK([whether more special flags are required for pthreads], [ax_cv_PTHREAD_SPECIAL_FLAGS], [ax_cv_PTHREAD_SPECIAL_FLAGS=no case $host_os in solaris*) ax_cv_PTHREAD_SPECIAL_FLAGS="-D_POSIX_PTHREAD_SEMANTICS" ;; esac ]) AS_IF([test "x$ax_cv_PTHREAD_SPECIAL_FLAGS" != "xno" && \ test "x$ax_pthread_special_flags_added" != "xyes"], [PTHREAD_CFLAGS="$ax_cv_PTHREAD_SPECIAL_FLAGS $PTHREAD_CFLAGS" ax_pthread_special_flags_added=yes]) AC_CACHE_CHECK([for PTHREAD_PRIO_INHERIT], [ax_cv_PTHREAD_PRIO_INHERIT], [AC_LINK_IFELSE([AC_LANG_PROGRAM([[#include ]], [[int i = PTHREAD_PRIO_INHERIT;]])], [ax_cv_PTHREAD_PRIO_INHERIT=yes], [ax_cv_PTHREAD_PRIO_INHERIT=no]) ]) AS_IF([test "x$ax_cv_PTHREAD_PRIO_INHERIT" = "xyes" && \ test "x$ax_pthread_prio_inherit_defined" != "xyes"], [AC_DEFINE([HAVE_PTHREAD_PRIO_INHERIT], [1], [Have PTHREAD_PRIO_INHERIT.]) ax_pthread_prio_inherit_defined=yes ]) CFLAGS="$ax_pthread_save_CFLAGS" LIBS="$ax_pthread_save_LIBS" # More AIX lossage: compile with *_r variant if test "x$GCC" != "xyes"; then case $host_os in aix*) AS_CASE(["x/$CC"], [x*/c89|x*/c89_128|x*/c99|x*/c99_128|x*/cc|x*/cc128|x*/xlc|x*/xlc_v6|x*/xlc128|x*/xlc128_v6], [#handle absolute path differently from PATH based program lookup AS_CASE(["x$CC"], [x/*], [AS_IF([AS_EXECUTABLE_P([${CC}_r])],[PTHREAD_CC="${CC}_r"])], [AC_CHECK_PROGS([PTHREAD_CC],[${CC}_r],[$CC])])]) ;; esac fi fi test -n "$PTHREAD_CC" || PTHREAD_CC="$CC" AC_SUBST([PTHREAD_LIBS]) AC_SUBST([PTHREAD_CFLAGS]) AC_SUBST([PTHREAD_CC]) # Finally, execute ACTION-IF-FOUND/ACTION-IF-NOT-FOUND: if test "x$ax_pthread_ok" = "xyes"; then ifelse([$1],,[AC_DEFINE([HAVE_PTHREAD],[1],[Define if you have POSIX threads libraries and header files.])],[$1]) : else ax_pthread_ok=no $2 fi AC_LANG_POP ])dnl AX_PTHREAD nDPI-2.2/packages/000077500000000000000000000000001321103654100137215ustar00rootroot00000000000000nDPI-2.2/packages/homebrew/000077500000000000000000000000001321103654100155315ustar00rootroot00000000000000nDPI-2.2/packages/homebrew/README000066400000000000000000000002631321103654100164120ustar00rootroot00000000000000=== HOMEBREW PACKAGE === NB: Work in progress - SUBMIT FORMULA cp ndpi.rb /usr/local/Library/Formula/ - INSTALL FORMULA #check the formula brew audit ndpi brew install -vd ndpinDPI-2.2/packages/homebrew/ndpi.rb000066400000000000000000000021371321103654100170130ustar00rootroot00000000000000class Ndpi < Formula desc "Deep Packet Inspection (DPI) library" homepage "http://www.ntop.org/products/ndpi/" url "https://downloads.sourceforge.net/project/ntop/nDPI/nDPI-1.8.tgz" sha256 "f490137a7387b69d0d55e990f2150b86d7b5eaae870e5326e8c2f18c17412443" bottle do cellar :any sha256 "05053767fc3c70557745c348c7352e7c2716c040ca54c5cf8d5306167c878fcb" => :el_capitan sha256 "34c0269039a0079820eeed862daa28158d9291f73f640a9415da60746d69a662" => :yosemite sha256 "a2af4dc62c24313593b3a20e45ca9d2d49f8efc0ea5e52fd064001ea441b93e4" => :mavericks sha256 "1bb200268a4d9df9bbe5d33bc773ee3bcf4b5d4fa00c76a040f16318438c284f" => :mountain_lion end depends_on "autoconf" => :build depends_on "automake" => :build depends_on "pkg-config" => :build depends_on "libtool" => :build depends_on "json-c" head "https://github.com/ntop/nDPI.git", :branch => "dev" def install system "./autogen.sh" system "./configure", "--prefix=#{prefix}" system "make" system "make", "install" end test do system "#{bin}/ndpiReader", "-i", test_fixtures("test.pcap") end end nDPI-2.2/packages/ubuntu/000077500000000000000000000000001321103654100152435ustar00rootroot00000000000000nDPI-2.2/packages/ubuntu/Makefile000066400000000000000000000025711321103654100167100ustar00rootroot00000000000000# # Change it according to your setup # NDPI_HOME=$(PWD)/../.. NDPI_BUILD=${NDPI_HOME}/packages/ubuntu all: clean ndpi ndpi: \rm -rf ./usr ./debian/tmp ./debian/ndpi-dev mkdir -p ./usr/local ./debian/ndpi-dev mkdir -p ./usr/local/ndpi/lib ./usr/local/ndpi/bin ./ndpi-dev/usr/local/include/ndpi/ cd ${NDPI_HOME}; ./autogen.sh; ./configure; make cp $(NDPI_HOME)/lib/libndpi.a $(NDPI_HOME)/lib/libndpi.so* ./usr/local/ndpi/lib/ cp $(NDPI_HOME)/example/ndpiReader ./usr/local/ndpi/bin/ cp $(NDPI_HOME)/src/include/*.h ndpi-dev/usr/local/include/ndpi/ -rm -fr ndpi-dev/usr/local/include/nprobe/ndpi/.svn ndpi-dev/usr/local/include/ndpi/Makefile* ndpi-dev/usr/local/include/ndpi/ndpi_win32.h* ndpi-dev/usr/local/include/ndpi/include -find ./usr/local/lib -name "*.la" -exec /bin/rm {} ';' @echo @find . -name "*~" -exec /bin/rm {} ';' dpkg-buildpackage -rfakeroot -d -us -uc dpkg-sig --sign builder -k 7921DF34 ../ndpi*deb @\rm -f ../ndpi*dsc ../ndpi*.gz ../ndpi*changes @/bin/mv ../ndpi*deb . @echo @echo "Package built." @/bin/ls ndpi*deb @echo "-------------------------------" -dpkg --contents ndpi*amd64.deb @echo "-------------------------------" @echo "-------------------------------" -dpkg --contents ndpi*all.deb @echo "-------------------------------" distclean: echo "dummy distclean" install: echo "dummy install" clean: -rm -rf *~ *deb debian/tmp ./usr nDPI-2.2/packages/ubuntu/Makefile.in000066400000000000000000000025711321103654100173150ustar00rootroot00000000000000# # Change it according to your setup # NDPI_HOME=$(PWD)/../.. NDPI_BUILD=${NDPI_HOME}/packages/ubuntu all: clean ndpi ndpi: \rm -rf ./usr ./debian/tmp ./debian/ndpi-dev mkdir -p ./usr/local ./debian/ndpi-dev mkdir -p ./usr/local/ndpi/lib ./usr/local/ndpi/bin ./ndpi-dev/usr/local/include/ndpi/ cd ${NDPI_HOME}; ./autogen.sh; ./configure; make cp $(NDPI_HOME)/lib/libndpi.a $(NDPI_HOME)/lib/libndpi.so* ./usr/local/ndpi/lib/ cp $(NDPI_HOME)/example/ndpiReader ./usr/local/ndpi/bin/ cp $(NDPI_HOME)/src/include/*.h ndpi-dev/usr/local/include/ndpi/ -rm -fr ndpi-dev/usr/local/include/nprobe/ndpi/.svn ndpi-dev/usr/local/include/ndpi/Makefile* ndpi-dev/usr/local/include/ndpi/ndpi_win32.h* ndpi-dev/usr/local/include/ndpi/include -find ./usr/local/lib -name "*.la" -exec /bin/rm {} ';' @echo @find . -name "*~" -exec /bin/rm {} ';' dpkg-buildpackage -rfakeroot -d -us -uc dpkg-sig --sign builder -k 7921DF34 ../ndpi*deb @\rm -f ../ndpi*dsc ../ndpi*.gz ../ndpi*changes @/bin/mv ../ndpi*deb . @echo @echo "Package built." @/bin/ls ndpi*deb @echo "-------------------------------" -dpkg --contents ndpi*amd64.deb @echo "-------------------------------" @echo "-------------------------------" -dpkg --contents ndpi*all.deb @echo "-------------------------------" distclean: echo "dummy distclean" install: echo "dummy install" clean: -rm -rf *~ *deb debian/tmp ./usr nDPI-2.2/packages/ubuntu/configure000077500000000000000000002443451321103654100171660ustar00rootroot00000000000000#! /bin/sh # Guess values for system-dependent variables and create Makefiles. # Generated by GNU Autoconf 2.69 for Makefile.in 1.0. # # # Copyright (C) 1992-1996, 1998-2012 Free Software Foundation, Inc. # # # This configure script is free software; the Free Software Foundation # gives unlimited permission to copy, distribute and modify it. ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # Use a proper internal environment variable to ensure we don't fall # into an infinite loop, continuously re-executing ourselves. if test x"${_as_can_reexec}" != xno && test "x$CONFIG_SHELL" != x; then _as_can_reexec=no; export _as_can_reexec; # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. $as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2 as_fn_exit 255 fi # We don't want this to propagate to other subprocesses. { _as_can_reexec=; unset _as_can_reexec;} if test "x$CONFIG_SHELL" = x; then as_bourne_compatible="if test -n \"\${ZSH_VERSION+set}\" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on \${1+\"\$@\"}, which # is contrary to our usage. Disable this feature. alias -g '\${1+\"\$@\"}'='\"\$@\"' setopt NO_GLOB_SUBST else case \`(set -o) 2>/dev/null\` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi " as_required="as_fn_return () { (exit \$1); } as_fn_success () { as_fn_return 0; } as_fn_failure () { as_fn_return 1; } as_fn_ret_success () { return 0; } as_fn_ret_failure () { return 1; } exitcode=0 as_fn_success || { exitcode=1; echo as_fn_success failed.; } as_fn_failure && { exitcode=1; echo as_fn_failure succeeded.; } as_fn_ret_success || { exitcode=1; echo as_fn_ret_success failed.; } as_fn_ret_failure && { exitcode=1; echo as_fn_ret_failure succeeded.; } if ( set x; as_fn_ret_success y && test x = \"\$1\" ); then : else exitcode=1; echo positional parameters were not saved. fi test x\$exitcode = x0 || exit 1 test -x / || exit 1" as_suggested=" as_lineno_1=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_1a=\$LINENO as_lineno_2=";as_suggested=$as_suggested$LINENO;as_suggested=$as_suggested" as_lineno_2a=\$LINENO eval 'test \"x\$as_lineno_1'\$as_run'\" != \"x\$as_lineno_2'\$as_run'\" && test \"x\`expr \$as_lineno_1'\$as_run' + 1\`\" = \"x\$as_lineno_2'\$as_run'\"' || exit 1" if (eval "$as_required") 2>/dev/null; then : as_have_required=yes else as_have_required=no fi if test x$as_have_required = xyes && (eval "$as_suggested") 2>/dev/null; then : else as_save_IFS=$IFS; IFS=$PATH_SEPARATOR as_found=false for as_dir in /bin$PATH_SEPARATOR/usr/bin$PATH_SEPARATOR$PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. as_found=: case $as_dir in #( /*) for as_base in sh bash ksh sh5; do # Try only shells that exist, to save several forks. as_shell=$as_dir/$as_base if { test -f "$as_shell" || test -f "$as_shell.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$as_shell"; } 2>/dev/null; then : CONFIG_SHELL=$as_shell as_have_required=yes if { $as_echo "$as_bourne_compatible""$as_suggested" | as_run=a "$as_shell"; } 2>/dev/null; then : break 2 fi fi done;; esac as_found=false done $as_found || { if { test -f "$SHELL" || test -f "$SHELL.exe"; } && { $as_echo "$as_bourne_compatible""$as_required" | as_run=a "$SHELL"; } 2>/dev/null; then : CONFIG_SHELL=$SHELL as_have_required=yes fi; } IFS=$as_save_IFS if test "x$CONFIG_SHELL" != x; then : export CONFIG_SHELL # We cannot yet assume a decent shell, so we have to provide a # neutralization value for shells without unset; and this also # works around shells that cannot unset nonexistent variables. # Preserve -v and -x to the replacement shell. BASH_ENV=/dev/null ENV=/dev/null (unset BASH_ENV) >/dev/null 2>&1 && unset BASH_ENV ENV case $- in # (((( *v*x* | *x*v* ) as_opts=-vx ;; *v* ) as_opts=-v ;; *x* ) as_opts=-x ;; * ) as_opts= ;; esac exec $CONFIG_SHELL $as_opts "$as_myself" ${1+"$@"} # Admittedly, this is quite paranoid, since all the known shells bail # out after a failed `exec'. $as_echo "$0: could not re-execute with $CONFIG_SHELL" >&2 exit 255 fi if test x$as_have_required = xno; then : $as_echo "$0: This script requires a shell more modern than all" $as_echo "$0: the shells that I found on your system." if test x${ZSH_VERSION+set} = xset ; then $as_echo "$0: In particular, zsh $ZSH_VERSION has bugs and should" $as_echo "$0: be upgraded to zsh 4.3.4 or later." else $as_echo "$0: Please tell bug-autoconf@gnu.org about your system, $0: including any error possibly output before this $0: message. Then install a modern shell, or manually run $0: the script under such a shell if you do have one." fi exit 1 fi fi fi SHELL=${CONFIG_SHELL-/bin/sh} export SHELL # Unset more variables known to interfere with behavior of common tools. CLICOLOR_FORCE= GREP_OPTIONS= unset CLICOLOR_FORCE GREP_OPTIONS ## --------------------- ## ## M4sh Shell Functions. ## ## --------------------- ## # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits as_lineno_1=$LINENO as_lineno_1a=$LINENO as_lineno_2=$LINENO as_lineno_2a=$LINENO eval 'test "x$as_lineno_1'$as_run'" != "x$as_lineno_2'$as_run'" && test "x`expr $as_lineno_1'$as_run' + 1`" = "x$as_lineno_2'$as_run'"' || { # Blame Lee E. McMahon (1931-1989) for sed's syntax. :-) sed -n ' p /[$]LINENO/= ' <$as_myself | sed ' s/[$]LINENO.*/&-/ t lineno b :lineno N :loop s/[$]LINENO\([^'$as_cr_alnum'_].*\n\)\(.*\)/\2\1\2/ t loop s/-\n.*// ' >$as_me.lineno && chmod +x "$as_me.lineno" || { $as_echo "$as_me: error: cannot create $as_me.lineno; rerun with a POSIX shell" >&2; as_fn_exit 1; } # If we had to re-execute with $CONFIG_SHELL, we're ensured to have # already done that, so ensure we don't try to do so again and fall # in an infinite loop. This has already happened in practice. _as_can_reexec=no; export _as_can_reexec # Don't try to exec as it changes $[0], causing all sort of problems # (the dirname of $[0] is not the place where we might find the # original and so on. Autoconf is especially sensitive to this). . "./$as_me.lineno" # Exit status is that of the last command. exit } ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" test -n "$DJDIR" || exec 7<&0 &1 # Name of the host. # hostname on some systems (SVR3.2, old GNU/Linux) returns a bogus exit status, # so uname gets run too. ac_hostname=`(hostname || uname -n) 2>/dev/null | sed 1q` # # Initializations. # ac_default_prefix=/usr/local ac_clean_files= ac_config_libobj_dir=. LIBOBJS= cross_compiling=no subdirs= MFLAGS= MAKEFLAGS= # Identity of this package. PACKAGE_NAME='Makefile.in' PACKAGE_TARNAME='makefile-in' PACKAGE_VERSION='1.0' PACKAGE_STRING='Makefile.in 1.0' PACKAGE_BUGREPORT='' PACKAGE_URL='' ac_subst_vars='LTLIBOBJS LIBOBJS PFRING_SVN_RELEASE SVN_RELEASE KERNEL DATE EXTN MACHINE PFRING_VERS NDPI_VERS target_alias host_alias build_alias LIBS ECHO_T ECHO_N ECHO_C DEFS mandir localedir libdir psdir pdfdir dvidir htmldir infodir docdir oldincludedir includedir localstatedir sharedstatedir sysconfdir datadir datarootdir libexecdir sbindir bindir program_transform_name prefix exec_prefix PACKAGE_URL PACKAGE_BUGREPORT PACKAGE_STRING PACKAGE_VERSION PACKAGE_TARNAME PACKAGE_NAME PATH_SEPARATOR SHELL' ac_subst_files='' ac_user_opts=' enable_option_checking ' ac_precious_vars='build_alias host_alias target_alias' # Initialize some variables set by options. ac_init_help= ac_init_version=false ac_unrecognized_opts= ac_unrecognized_sep= # The variables have the same names as the options, with # dashes changed to underlines. cache_file=/dev/null exec_prefix=NONE no_create= no_recursion= prefix=NONE program_prefix=NONE program_suffix=NONE program_transform_name=s,x,x, silent= site= srcdir= verbose= x_includes=NONE x_libraries=NONE # Installation directory options. # These are left unexpanded so users can "make install exec_prefix=/foo" # and all the variables that are supposed to be based on exec_prefix # by default will actually change. # Use braces instead of parens because sh, perl, etc. also accept them. # (The list follows the same order as the GNU Coding Standards.) bindir='${exec_prefix}/bin' sbindir='${exec_prefix}/sbin' libexecdir='${exec_prefix}/libexec' datarootdir='${prefix}/share' datadir='${datarootdir}' sysconfdir='${prefix}/etc' sharedstatedir='${prefix}/com' localstatedir='${prefix}/var' includedir='${prefix}/include' oldincludedir='/usr/include' docdir='${datarootdir}/doc/${PACKAGE_TARNAME}' infodir='${datarootdir}/info' htmldir='${docdir}' dvidir='${docdir}' pdfdir='${docdir}' psdir='${docdir}' libdir='${exec_prefix}/lib' localedir='${datarootdir}/locale' mandir='${datarootdir}/man' ac_prev= ac_dashdash= for ac_option do # If the previous option needs an argument, assign it. if test -n "$ac_prev"; then eval $ac_prev=\$ac_option ac_prev= continue fi case $ac_option in *=?*) ac_optarg=`expr "X$ac_option" : '[^=]*=\(.*\)'` ;; *=) ac_optarg= ;; *) ac_optarg=yes ;; esac # Accept the important Cygnus configure options, so we can diagnose typos. case $ac_dashdash$ac_option in --) ac_dashdash=yes ;; -bindir | --bindir | --bindi | --bind | --bin | --bi) ac_prev=bindir ;; -bindir=* | --bindir=* | --bindi=* | --bind=* | --bin=* | --bi=*) bindir=$ac_optarg ;; -build | --build | --buil | --bui | --bu) ac_prev=build_alias ;; -build=* | --build=* | --buil=* | --bui=* | --bu=*) build_alias=$ac_optarg ;; -cache-file | --cache-file | --cache-fil | --cache-fi \ | --cache-f | --cache- | --cache | --cach | --cac | --ca | --c) ac_prev=cache_file ;; -cache-file=* | --cache-file=* | --cache-fil=* | --cache-fi=* \ | --cache-f=* | --cache-=* | --cache=* | --cach=* | --cac=* | --ca=* | --c=*) cache_file=$ac_optarg ;; --config-cache | -C) cache_file=config.cache ;; -datadir | --datadir | --datadi | --datad) ac_prev=datadir ;; -datadir=* | --datadir=* | --datadi=* | --datad=*) datadir=$ac_optarg ;; -datarootdir | --datarootdir | --datarootdi | --datarootd | --dataroot \ | --dataroo | --dataro | --datar) ac_prev=datarootdir ;; -datarootdir=* | --datarootdir=* | --datarootdi=* | --datarootd=* \ | --dataroot=* | --dataroo=* | --dataro=* | --datar=*) datarootdir=$ac_optarg ;; -disable-* | --disable-*) ac_useropt=`expr "x$ac_option" : 'x-*disable-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--disable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=no ;; -docdir | --docdir | --docdi | --doc | --do) ac_prev=docdir ;; -docdir=* | --docdir=* | --docdi=* | --doc=* | --do=*) docdir=$ac_optarg ;; -dvidir | --dvidir | --dvidi | --dvid | --dvi | --dv) ac_prev=dvidir ;; -dvidir=* | --dvidir=* | --dvidi=* | --dvid=* | --dvi=* | --dv=*) dvidir=$ac_optarg ;; -enable-* | --enable-*) ac_useropt=`expr "x$ac_option" : 'x-*enable-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid feature name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "enable_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--enable-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval enable_$ac_useropt=\$ac_optarg ;; -exec-prefix | --exec_prefix | --exec-prefix | --exec-prefi \ | --exec-pref | --exec-pre | --exec-pr | --exec-p | --exec- \ | --exec | --exe | --ex) ac_prev=exec_prefix ;; -exec-prefix=* | --exec_prefix=* | --exec-prefix=* | --exec-prefi=* \ | --exec-pref=* | --exec-pre=* | --exec-pr=* | --exec-p=* | --exec-=* \ | --exec=* | --exe=* | --ex=*) exec_prefix=$ac_optarg ;; -gas | --gas | --ga | --g) # Obsolete; use --with-gas. with_gas=yes ;; -help | --help | --hel | --he | -h) ac_init_help=long ;; -help=r* | --help=r* | --hel=r* | --he=r* | -hr*) ac_init_help=recursive ;; -help=s* | --help=s* | --hel=s* | --he=s* | -hs*) ac_init_help=short ;; -host | --host | --hos | --ho) ac_prev=host_alias ;; -host=* | --host=* | --hos=* | --ho=*) host_alias=$ac_optarg ;; -htmldir | --htmldir | --htmldi | --htmld | --html | --htm | --ht) ac_prev=htmldir ;; -htmldir=* | --htmldir=* | --htmldi=* | --htmld=* | --html=* | --htm=* \ | --ht=*) htmldir=$ac_optarg ;; -includedir | --includedir | --includedi | --included | --include \ | --includ | --inclu | --incl | --inc) ac_prev=includedir ;; -includedir=* | --includedir=* | --includedi=* | --included=* | --include=* \ | --includ=* | --inclu=* | --incl=* | --inc=*) includedir=$ac_optarg ;; -infodir | --infodir | --infodi | --infod | --info | --inf) ac_prev=infodir ;; -infodir=* | --infodir=* | --infodi=* | --infod=* | --info=* | --inf=*) infodir=$ac_optarg ;; -libdir | --libdir | --libdi | --libd) ac_prev=libdir ;; -libdir=* | --libdir=* | --libdi=* | --libd=*) libdir=$ac_optarg ;; -libexecdir | --libexecdir | --libexecdi | --libexecd | --libexec \ | --libexe | --libex | --libe) ac_prev=libexecdir ;; -libexecdir=* | --libexecdir=* | --libexecdi=* | --libexecd=* | --libexec=* \ | --libexe=* | --libex=* | --libe=*) libexecdir=$ac_optarg ;; -localedir | --localedir | --localedi | --localed | --locale) ac_prev=localedir ;; -localedir=* | --localedir=* | --localedi=* | --localed=* | --locale=*) localedir=$ac_optarg ;; -localstatedir | --localstatedir | --localstatedi | --localstated \ | --localstate | --localstat | --localsta | --localst | --locals) ac_prev=localstatedir ;; -localstatedir=* | --localstatedir=* | --localstatedi=* | --localstated=* \ | --localstate=* | --localstat=* | --localsta=* | --localst=* | --locals=*) localstatedir=$ac_optarg ;; -mandir | --mandir | --mandi | --mand | --man | --ma | --m) ac_prev=mandir ;; -mandir=* | --mandir=* | --mandi=* | --mand=* | --man=* | --ma=* | --m=*) mandir=$ac_optarg ;; -nfp | --nfp | --nf) # Obsolete; use --without-fp. with_fp=no ;; -no-create | --no-create | --no-creat | --no-crea | --no-cre \ | --no-cr | --no-c | -n) no_create=yes ;; -no-recursion | --no-recursion | --no-recursio | --no-recursi \ | --no-recurs | --no-recur | --no-recu | --no-rec | --no-re | --no-r) no_recursion=yes ;; -oldincludedir | --oldincludedir | --oldincludedi | --oldincluded \ | --oldinclude | --oldinclud | --oldinclu | --oldincl | --oldinc \ | --oldin | --oldi | --old | --ol | --o) ac_prev=oldincludedir ;; -oldincludedir=* | --oldincludedir=* | --oldincludedi=* | --oldincluded=* \ | --oldinclude=* | --oldinclud=* | --oldinclu=* | --oldincl=* | --oldinc=* \ | --oldin=* | --oldi=* | --old=* | --ol=* | --o=*) oldincludedir=$ac_optarg ;; -prefix | --prefix | --prefi | --pref | --pre | --pr | --p) ac_prev=prefix ;; -prefix=* | --prefix=* | --prefi=* | --pref=* | --pre=* | --pr=* | --p=*) prefix=$ac_optarg ;; -program-prefix | --program-prefix | --program-prefi | --program-pref \ | --program-pre | --program-pr | --program-p) ac_prev=program_prefix ;; -program-prefix=* | --program-prefix=* | --program-prefi=* \ | --program-pref=* | --program-pre=* | --program-pr=* | --program-p=*) program_prefix=$ac_optarg ;; -program-suffix | --program-suffix | --program-suffi | --program-suff \ | --program-suf | --program-su | --program-s) ac_prev=program_suffix ;; -program-suffix=* | --program-suffix=* | --program-suffi=* \ | --program-suff=* | --program-suf=* | --program-su=* | --program-s=*) program_suffix=$ac_optarg ;; -program-transform-name | --program-transform-name \ | --program-transform-nam | --program-transform-na \ | --program-transform-n | --program-transform- \ | --program-transform | --program-transfor \ | --program-transfo | --program-transf \ | --program-trans | --program-tran \ | --progr-tra | --program-tr | --program-t) ac_prev=program_transform_name ;; -program-transform-name=* | --program-transform-name=* \ | --program-transform-nam=* | --program-transform-na=* \ | --program-transform-n=* | --program-transform-=* \ | --program-transform=* | --program-transfor=* \ | --program-transfo=* | --program-transf=* \ | --program-trans=* | --program-tran=* \ | --progr-tra=* | --program-tr=* | --program-t=*) program_transform_name=$ac_optarg ;; -pdfdir | --pdfdir | --pdfdi | --pdfd | --pdf | --pd) ac_prev=pdfdir ;; -pdfdir=* | --pdfdir=* | --pdfdi=* | --pdfd=* | --pdf=* | --pd=*) pdfdir=$ac_optarg ;; -psdir | --psdir | --psdi | --psd | --ps) ac_prev=psdir ;; -psdir=* | --psdir=* | --psdi=* | --psd=* | --ps=*) psdir=$ac_optarg ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) silent=yes ;; -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb) ac_prev=sbindir ;; -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \ | --sbi=* | --sb=*) sbindir=$ac_optarg ;; -sharedstatedir | --sharedstatedir | --sharedstatedi \ | --sharedstated | --sharedstate | --sharedstat | --sharedsta \ | --sharedst | --shareds | --shared | --share | --shar \ | --sha | --sh) ac_prev=sharedstatedir ;; -sharedstatedir=* | --sharedstatedir=* | --sharedstatedi=* \ | --sharedstated=* | --sharedstate=* | --sharedstat=* | --sharedsta=* \ | --sharedst=* | --shareds=* | --shared=* | --share=* | --shar=* \ | --sha=* | --sh=*) sharedstatedir=$ac_optarg ;; -site | --site | --sit) ac_prev=site ;; -site=* | --site=* | --sit=*) site=$ac_optarg ;; -srcdir | --srcdir | --srcdi | --srcd | --src | --sr) ac_prev=srcdir ;; -srcdir=* | --srcdir=* | --srcdi=* | --srcd=* | --src=* | --sr=*) srcdir=$ac_optarg ;; -sysconfdir | --sysconfdir | --sysconfdi | --sysconfd | --sysconf \ | --syscon | --sysco | --sysc | --sys | --sy) ac_prev=sysconfdir ;; -sysconfdir=* | --sysconfdir=* | --sysconfdi=* | --sysconfd=* | --sysconf=* \ | --syscon=* | --sysco=* | --sysc=* | --sys=* | --sy=*) sysconfdir=$ac_optarg ;; -target | --target | --targe | --targ | --tar | --ta | --t) ac_prev=target_alias ;; -target=* | --target=* | --targe=* | --targ=* | --tar=* | --ta=* | --t=*) target_alias=$ac_optarg ;; -v | -verbose | --verbose | --verbos | --verbo | --verb) verbose=yes ;; -version | --version | --versio | --versi | --vers | -V) ac_init_version=: ;; -with-* | --with-*) ac_useropt=`expr "x$ac_option" : 'x-*with-\([^=]*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--with-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=\$ac_optarg ;; -without-* | --without-*) ac_useropt=`expr "x$ac_option" : 'x-*without-\(.*\)'` # Reject names that are not valid shell variable names. expr "x$ac_useropt" : ".*[^-+._$as_cr_alnum]" >/dev/null && as_fn_error $? "invalid package name: $ac_useropt" ac_useropt_orig=$ac_useropt ac_useropt=`$as_echo "$ac_useropt" | sed 's/[-+.]/_/g'` case $ac_user_opts in *" "with_$ac_useropt" "*) ;; *) ac_unrecognized_opts="$ac_unrecognized_opts$ac_unrecognized_sep--without-$ac_useropt_orig" ac_unrecognized_sep=', ';; esac eval with_$ac_useropt=no ;; --x) # Obsolete; use --with-x. with_x=yes ;; -x-includes | --x-includes | --x-include | --x-includ | --x-inclu \ | --x-incl | --x-inc | --x-in | --x-i) ac_prev=x_includes ;; -x-includes=* | --x-includes=* | --x-include=* | --x-includ=* | --x-inclu=* \ | --x-incl=* | --x-inc=* | --x-in=* | --x-i=*) x_includes=$ac_optarg ;; -x-libraries | --x-libraries | --x-librarie | --x-librari \ | --x-librar | --x-libra | --x-libr | --x-lib | --x-li | --x-l) ac_prev=x_libraries ;; -x-libraries=* | --x-libraries=* | --x-librarie=* | --x-librari=* \ | --x-librar=* | --x-libra=* | --x-libr=* | --x-lib=* | --x-li=* | --x-l=*) x_libraries=$ac_optarg ;; -*) as_fn_error $? "unrecognized option: \`$ac_option' Try \`$0 --help' for more information" ;; *=*) ac_envvar=`expr "x$ac_option" : 'x\([^=]*\)='` # Reject names that are not valid shell variable names. case $ac_envvar in #( '' | [0-9]* | *[!_$as_cr_alnum]* ) as_fn_error $? "invalid variable name: \`$ac_envvar'" ;; esac eval $ac_envvar=\$ac_optarg export $ac_envvar ;; *) # FIXME: should be removed in autoconf 3.0. $as_echo "$as_me: WARNING: you should use --build, --host, --target" >&2 expr "x$ac_option" : ".*[^-._$as_cr_alnum]" >/dev/null && $as_echo "$as_me: WARNING: invalid host type: $ac_option" >&2 : "${build_alias=$ac_option} ${host_alias=$ac_option} ${target_alias=$ac_option}" ;; esac done if test -n "$ac_prev"; then ac_option=--`echo $ac_prev | sed 's/_/-/g'` as_fn_error $? "missing argument to $ac_option" fi if test -n "$ac_unrecognized_opts"; then case $enable_option_checking in no) ;; fatal) as_fn_error $? "unrecognized options: $ac_unrecognized_opts" ;; *) $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2 ;; esac fi # Check all directory arguments for consistency. for ac_var in exec_prefix prefix bindir sbindir libexecdir datarootdir \ datadir sysconfdir sharedstatedir localstatedir includedir \ oldincludedir docdir infodir htmldir dvidir pdfdir psdir \ libdir localedir mandir do eval ac_val=\$$ac_var # Remove trailing slashes. case $ac_val in */ ) ac_val=`expr "X$ac_val" : 'X\(.*[^/]\)' \| "X$ac_val" : 'X\(.*\)'` eval $ac_var=\$ac_val;; esac # Be sure to have absolute directory names. case $ac_val in [\\/$]* | ?:[\\/]* ) continue;; NONE | '' ) case $ac_var in *prefix ) continue;; esac;; esac as_fn_error $? "expected an absolute directory name for --$ac_var: $ac_val" done # There might be people who depend on the old broken behavior: `$host' # used to hold the argument of --host etc. # FIXME: To remove some day. build=$build_alias host=$host_alias target=$target_alias # FIXME: To remove some day. if test "x$host_alias" != x; then if test "x$build_alias" = x; then cross_compiling=maybe elif test "x$build_alias" != "x$host_alias"; then cross_compiling=yes fi fi ac_tool_prefix= test -n "$host_alias" && ac_tool_prefix=$host_alias- test "$silent" = yes && exec 6>/dev/null ac_pwd=`pwd` && test -n "$ac_pwd" && ac_ls_di=`ls -di .` && ac_pwd_ls_di=`cd "$ac_pwd" && ls -di .` || as_fn_error $? "working directory cannot be determined" test "X$ac_ls_di" = "X$ac_pwd_ls_di" || as_fn_error $? "pwd does not report name of working directory" # Find the source files, if location was not specified. if test -z "$srcdir"; then ac_srcdir_defaulted=yes # Try the directory containing this script, then the parent directory. ac_confdir=`$as_dirname -- "$as_myself" || $as_expr X"$as_myself" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_myself" : 'X\(//\)[^/]' \| \ X"$as_myself" : 'X\(//\)$' \| \ X"$as_myself" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_myself" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` srcdir=$ac_confdir if test ! -r "$srcdir/$ac_unique_file"; then srcdir=.. fi else ac_srcdir_defaulted=no fi if test ! -r "$srcdir/$ac_unique_file"; then test "$ac_srcdir_defaulted" = yes && srcdir="$ac_confdir or .." as_fn_error $? "cannot find sources ($ac_unique_file) in $srcdir" fi ac_msg="sources are in $srcdir, but \`cd $srcdir' does not work" ac_abs_confdir=`( cd "$srcdir" && test -r "./$ac_unique_file" || as_fn_error $? "$ac_msg" pwd)` # When building in place, set srcdir=. if test "$ac_abs_confdir" = "$ac_pwd"; then srcdir=. fi # Remove unnecessary trailing slashes from srcdir. # Double slashes in file names in object file debugging info # mess up M-x gdb in Emacs. case $srcdir in */) srcdir=`expr "X$srcdir" : 'X\(.*[^/]\)' \| "X$srcdir" : 'X\(.*\)'`;; esac for ac_var in $ac_precious_vars; do eval ac_env_${ac_var}_set=\${${ac_var}+set} eval ac_env_${ac_var}_value=\$${ac_var} eval ac_cv_env_${ac_var}_set=\${${ac_var}+set} eval ac_cv_env_${ac_var}_value=\$${ac_var} done # # Report the --help message. # if test "$ac_init_help" = "long"; then # Omit some internal or obsolete options to make the list less imposing. # This message is too long to be a string in the A/UX 3.1 sh. cat <<_ACEOF \`configure' configures Makefile.in 1.0 to adapt to many kinds of systems. Usage: $0 [OPTION]... [VAR=VALUE]... To assign environment variables (e.g., CC, CFLAGS...), specify them as VAR=VALUE. See below for descriptions of some of the useful variables. Defaults for the options are specified in brackets. Configuration: -h, --help display this help and exit --help=short display options specific to this package --help=recursive display the short help of all the included packages -V, --version display version information and exit -q, --quiet, --silent do not print \`checking ...' messages --cache-file=FILE cache test results in FILE [disabled] -C, --config-cache alias for \`--cache-file=config.cache' -n, --no-create do not create output files --srcdir=DIR find the sources in DIR [configure dir or \`..'] Installation directories: --prefix=PREFIX install architecture-independent files in PREFIX [$ac_default_prefix] --exec-prefix=EPREFIX install architecture-dependent files in EPREFIX [PREFIX] By default, \`make install' will install all the files in \`$ac_default_prefix/bin', \`$ac_default_prefix/lib' etc. You can specify an installation prefix other than \`$ac_default_prefix' using \`--prefix', for instance \`--prefix=\$HOME'. For better control, use the options below. Fine tuning of the installation directories: --bindir=DIR user executables [EPREFIX/bin] --sbindir=DIR system admin executables [EPREFIX/sbin] --libexecdir=DIR program executables [EPREFIX/libexec] --sysconfdir=DIR read-only single-machine data [PREFIX/etc] --sharedstatedir=DIR modifiable architecture-independent data [PREFIX/com] --localstatedir=DIR modifiable single-machine data [PREFIX/var] --libdir=DIR object code libraries [EPREFIX/lib] --includedir=DIR C header files [PREFIX/include] --oldincludedir=DIR C header files for non-gcc [/usr/include] --datarootdir=DIR read-only arch.-independent data root [PREFIX/share] --datadir=DIR read-only architecture-independent data [DATAROOTDIR] --infodir=DIR info documentation [DATAROOTDIR/info] --localedir=DIR locale-dependent data [DATAROOTDIR/locale] --mandir=DIR man documentation [DATAROOTDIR/man] --docdir=DIR documentation root [DATAROOTDIR/doc/makefile-in] --htmldir=DIR html documentation [DOCDIR] --dvidir=DIR dvi documentation [DOCDIR] --pdfdir=DIR pdf documentation [DOCDIR] --psdir=DIR ps documentation [DOCDIR] _ACEOF cat <<\_ACEOF _ACEOF fi if test -n "$ac_init_help"; then case $ac_init_help in short | recursive ) echo "Configuration of Makefile.in 1.0:";; esac cat <<\_ACEOF Report bugs to the package provider. _ACEOF ac_status=$? fi if test "$ac_init_help" = "recursive"; then # If there are subdirs, report their specific --help. for ac_dir in : $ac_subdirs_all; do test "x$ac_dir" = x: && continue test -d "$ac_dir" || { cd "$srcdir" && ac_pwd=`pwd` && srcdir=. && test -d "$ac_dir"; } || continue ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix cd "$ac_dir" || { ac_status=$?; continue; } # Check for guested configure. if test -f "$ac_srcdir/configure.gnu"; then echo && $SHELL "$ac_srcdir/configure.gnu" --help=recursive elif test -f "$ac_srcdir/configure"; then echo && $SHELL "$ac_srcdir/configure" --help=recursive else $as_echo "$as_me: WARNING: no configuration information is in $ac_dir" >&2 fi || ac_status=$? cd "$ac_pwd" || { ac_status=$?; break; } done fi test -n "$ac_init_help" && exit $ac_status if $ac_init_version; then cat <<\_ACEOF Makefile.in configure 1.0 generated by GNU Autoconf 2.69 Copyright (C) 2012 Free Software Foundation, Inc. This configure script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it. _ACEOF exit fi ## ------------------------ ## ## Autoconf initialization. ## ## ------------------------ ## cat >config.log <<_ACEOF This file contains any messages produced by compilers while running configure, to aid debugging if configure makes a mistake. It was created by Makefile.in $as_me 1.0, which was generated by GNU Autoconf 2.69. Invocation command line was $ $0 $@ _ACEOF exec 5>>config.log { cat <<_ASUNAME ## --------- ## ## Platform. ## ## --------- ## hostname = `(hostname || uname -n) 2>/dev/null | sed 1q` uname -m = `(uname -m) 2>/dev/null || echo unknown` uname -r = `(uname -r) 2>/dev/null || echo unknown` uname -s = `(uname -s) 2>/dev/null || echo unknown` uname -v = `(uname -v) 2>/dev/null || echo unknown` /usr/bin/uname -p = `(/usr/bin/uname -p) 2>/dev/null || echo unknown` /bin/uname -X = `(/bin/uname -X) 2>/dev/null || echo unknown` /bin/arch = `(/bin/arch) 2>/dev/null || echo unknown` /usr/bin/arch -k = `(/usr/bin/arch -k) 2>/dev/null || echo unknown` /usr/convex/getsysinfo = `(/usr/convex/getsysinfo) 2>/dev/null || echo unknown` /usr/bin/hostinfo = `(/usr/bin/hostinfo) 2>/dev/null || echo unknown` /bin/machine = `(/bin/machine) 2>/dev/null || echo unknown` /usr/bin/oslevel = `(/usr/bin/oslevel) 2>/dev/null || echo unknown` /bin/universe = `(/bin/universe) 2>/dev/null || echo unknown` _ASUNAME as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. $as_echo "PATH: $as_dir" done IFS=$as_save_IFS } >&5 cat >&5 <<_ACEOF ## ----------- ## ## Core tests. ## ## ----------- ## _ACEOF # Keep a trace of the command line. # Strip out --no-create and --no-recursion so they do not pile up. # Strip out --silent because we don't want to record it for future runs. # Also quote any args containing shell meta-characters. # Make two passes to allow for proper duplicate-argument suppression. ac_configure_args= ac_configure_args0= ac_configure_args1= ac_must_keep_next=false for ac_pass in 1 2 do for ac_arg do case $ac_arg in -no-create | --no-c* | -n | -no-recursion | --no-r*) continue ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil) continue ;; *\'*) ac_arg=`$as_echo "$ac_arg" | sed "s/'/'\\\\\\\\''/g"` ;; esac case $ac_pass in 1) as_fn_append ac_configure_args0 " '$ac_arg'" ;; 2) as_fn_append ac_configure_args1 " '$ac_arg'" if test $ac_must_keep_next = true; then ac_must_keep_next=false # Got value, back to normal. else case $ac_arg in *=* | --config-cache | -C | -disable-* | --disable-* \ | -enable-* | --enable-* | -gas | --g* | -nfp | --nf* \ | -q | -quiet | --q* | -silent | --sil* | -v | -verb* \ | -with-* | --with-* | -without-* | --without-* | --x) case "$ac_configure_args0 " in "$ac_configure_args1"*" '$ac_arg' "* ) continue ;; esac ;; -* ) ac_must_keep_next=true ;; esac fi as_fn_append ac_configure_args " '$ac_arg'" ;; esac done done { ac_configure_args0=; unset ac_configure_args0;} { ac_configure_args1=; unset ac_configure_args1;} # When interrupted or exit'd, cleanup temporary files, and complete # config.log. We remove comments because anyway the quotes in there # would cause problems or look ugly. # WARNING: Use '\'' to represent an apostrophe within the trap. # WARNING: Do not start the trap code with a newline, due to a FreeBSD 4.0 bug. trap 'exit_status=$? # Save into config.log some information that might help in debugging. { echo $as_echo "## ---------------- ## ## Cache variables. ## ## ---------------- ##" echo # The following way of writing the cache mishandles newlines in values, ( for ac_var in `(set) 2>&1 | sed -n '\''s/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'\''`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space='\'' '\''; set) 2>&1` in #( *${as_nl}ac_space=\ *) sed -n \ "s/'\''/'\''\\\\'\'''\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\''\\2'\''/p" ;; #( *) sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) echo $as_echo "## ----------------- ## ## Output variables. ## ## ----------------- ##" echo for ac_var in $ac_subst_vars do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo if test -n "$ac_subst_files"; then $as_echo "## ------------------- ## ## File substitutions. ## ## ------------------- ##" echo for ac_var in $ac_subst_files do eval ac_val=\$$ac_var case $ac_val in *\'\''*) ac_val=`$as_echo "$ac_val" | sed "s/'\''/'\''\\\\\\\\'\'''\''/g"`;; esac $as_echo "$ac_var='\''$ac_val'\''" done | sort echo fi if test -s confdefs.h; then $as_echo "## ----------- ## ## confdefs.h. ## ## ----------- ##" echo cat confdefs.h echo fi test "$ac_signal" != 0 && $as_echo "$as_me: caught signal $ac_signal" $as_echo "$as_me: exit $exit_status" } >&5 rm -f core *.core core.conftest.* && rm -f -r conftest* confdefs* conf$$* $ac_clean_files && exit $exit_status ' 0 for ac_signal in 1 2 13 15; do trap 'ac_signal='$ac_signal'; as_fn_exit 1' $ac_signal done ac_signal=0 # confdefs.h avoids OS command line length limits that DEFS can exceed. rm -f -r conftest* confdefs.h $as_echo "/* confdefs.h */" > confdefs.h # Predefined preprocessor variables. cat >>confdefs.h <<_ACEOF #define PACKAGE_NAME "$PACKAGE_NAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_TARNAME "$PACKAGE_TARNAME" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_VERSION "$PACKAGE_VERSION" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_STRING "$PACKAGE_STRING" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_BUGREPORT "$PACKAGE_BUGREPORT" _ACEOF cat >>confdefs.h <<_ACEOF #define PACKAGE_URL "$PACKAGE_URL" _ACEOF # Let the site file select an alternate cache file if it wants to. # Prefer an explicitly selected file to automatically selected ones. ac_site_file1=NONE ac_site_file2=NONE if test -n "$CONFIG_SITE"; then # We do not want a PATH search for config.site. case $CONFIG_SITE in #(( -*) ac_site_file1=./$CONFIG_SITE;; */*) ac_site_file1=$CONFIG_SITE;; *) ac_site_file1=./$CONFIG_SITE;; esac elif test "x$prefix" != xNONE; then ac_site_file1=$prefix/share/config.site ac_site_file2=$prefix/etc/config.site else ac_site_file1=$ac_default_prefix/share/config.site ac_site_file2=$ac_default_prefix/etc/config.site fi for ac_site_file in "$ac_site_file1" "$ac_site_file2" do test "x$ac_site_file" = xNONE && continue if test /dev/null != "$ac_site_file" && test -r "$ac_site_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading site script $ac_site_file" >&5 $as_echo "$as_me: loading site script $ac_site_file" >&6;} sed 's/^/| /' "$ac_site_file" >&5 . "$ac_site_file" \ || { { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} as_fn_error $? "failed to load site script $ac_site_file See \`config.log' for more details" "$LINENO" 5; } fi done if test -r "$cache_file"; then # Some versions of bash will fail to source /dev/null (special files # actually), so we avoid doing that. DJGPP emulates it as a regular file. if test /dev/null != "$cache_file" && test -f "$cache_file"; then { $as_echo "$as_me:${as_lineno-$LINENO}: loading cache $cache_file" >&5 $as_echo "$as_me: loading cache $cache_file" >&6;} case $cache_file in [\\/]* | ?:[\\/]* ) . "$cache_file";; *) . "./$cache_file";; esac fi else { $as_echo "$as_me:${as_lineno-$LINENO}: creating cache $cache_file" >&5 $as_echo "$as_me: creating cache $cache_file" >&6;} >$cache_file fi # Check that the precious variables saved in the cache have kept the same # value. ac_cache_corrupted=false for ac_var in $ac_precious_vars; do eval ac_old_set=\$ac_cv_env_${ac_var}_set eval ac_new_set=\$ac_env_${ac_var}_set eval ac_old_val=\$ac_cv_env_${ac_var}_value eval ac_new_val=\$ac_env_${ac_var}_value case $ac_old_set,$ac_new_set in set,) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was set to \`$ac_old_val' in the previous run" >&2;} ac_cache_corrupted=: ;; ,set) { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' was not set in the previous run" >&5 $as_echo "$as_me: error: \`$ac_var' was not set in the previous run" >&2;} ac_cache_corrupted=: ;; ,);; *) if test "x$ac_old_val" != "x$ac_new_val"; then # differences in whitespace do not lead to failure. ac_old_val_w=`echo x $ac_old_val` ac_new_val_w=`echo x $ac_new_val` if test "$ac_old_val_w" != "$ac_new_val_w"; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: \`$ac_var' has changed since the previous run:" >&5 $as_echo "$as_me: error: \`$ac_var' has changed since the previous run:" >&2;} ac_cache_corrupted=: else { $as_echo "$as_me:${as_lineno-$LINENO}: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&5 $as_echo "$as_me: warning: ignoring whitespace changes in \`$ac_var' since the previous run:" >&2;} eval $ac_var=\$ac_old_val fi { $as_echo "$as_me:${as_lineno-$LINENO}: former value: \`$ac_old_val'" >&5 $as_echo "$as_me: former value: \`$ac_old_val'" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: current value: \`$ac_new_val'" >&5 $as_echo "$as_me: current value: \`$ac_new_val'" >&2;} fi;; esac # Pass precious variables to config.status. if test "$ac_new_set" = set; then case $ac_new_val in *\'*) ac_arg=$ac_var=`$as_echo "$ac_new_val" | sed "s/'/'\\\\\\\\''/g"` ;; *) ac_arg=$ac_var=$ac_new_val ;; esac case " $ac_configure_args " in *" '$ac_arg' "*) ;; # Avoid dups. Use of quotes ensures accuracy. *) as_fn_append ac_configure_args " '$ac_arg'" ;; esac fi done if $ac_cache_corrupted; then { $as_echo "$as_me:${as_lineno-$LINENO}: error: in \`$ac_pwd':" >&5 $as_echo "$as_me: error: in \`$ac_pwd':" >&2;} { $as_echo "$as_me:${as_lineno-$LINENO}: error: changes in the environment can compromise the build" >&5 $as_echo "$as_me: error: changes in the environment can compromise the build" >&2;} as_fn_error $? "run \`make distclean' and/or \`rm $cache_file' and start over" "$LINENO" 5 fi ## -------------------- ## ## Main body of script. ## ## -------------------- ## ac_ext=c ac_cpp='$CPP $CPPFLAGS' ac_compile='$CC -c $CFLAGS $CPPFLAGS conftest.$ac_ext >&5' ac_link='$CC -o conftest$ac_exeext $CFLAGS $CPPFLAGS $LDFLAGS conftest.$ac_ext $LIBS >&5' ac_compiler_gnu=$ac_cv_c_compiler_gnu NDPI_VERS=`cat ../../config.h | grep -w VERSION | cut -d \" -f 2` PFRING_VERS=`cat $HOME/PF_RING/kernel/linux/pf_ring.h | grep RING_VERSION | head -1 | cut -d '"' -f 2` SVN_RELEASE=`svn info ../.. | grep "^Revision"|cut -d " " -f 2` PFRING_SVN_RELEASE=`svn info $HOME/PF_RING | grep "^Revision"|cut -d " " -f 2` MACHINE=`uname -m` if test $MACHINE = "x86_64"; then EXTN="amd64" else EXTN="i386" fi DATE=`date -R` KERNEL=`uname -r` ac_config_files="$ac_config_files Makefile" ac_config_files="$ac_config_files debian/changelog" ac_config_files="$ac_config_files debian/files" ac_config_files="$ac_config_files debian/control" cat >confcache <<\_ACEOF # This file is a shell script that caches the results of configure # tests run on this system so they can be shared between configure # scripts and configure runs, see configure's option --config-cache. # It is not useful on other systems. If it contains results you don't # want to keep, you may remove or edit it. # # config.status only pays attention to the cache file if you give it # the --recheck option to rerun configure. # # `ac_cv_env_foo' variables (set or unset) will be overridden when # loading this file, other *unset* `ac_cv_foo' will be assigned the # following values. _ACEOF # The following way of writing the cache mishandles newlines in values, # but we know of no workaround that is simple, portable, and efficient. # So, we kill variables containing newlines. # Ultrix sh set writes to stderr and can't be redirected directly, # and sets the high bit in the cache file unless we assign to the vars. ( for ac_var in `(set) 2>&1 | sed -n 's/^\([a-zA-Z_][a-zA-Z0-9_]*\)=.*/\1/p'`; do eval ac_val=\$$ac_var case $ac_val in #( *${as_nl}*) case $ac_var in #( *_cv_*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: cache variable $ac_var contains a newline" >&5 $as_echo "$as_me: WARNING: cache variable $ac_var contains a newline" >&2;} ;; esac case $ac_var in #( _ | IFS | as_nl) ;; #( BASH_ARGV | BASH_SOURCE) eval $ac_var= ;; #( *) { eval $ac_var=; unset $ac_var;} ;; esac ;; esac done (set) 2>&1 | case $as_nl`(ac_space=' '; set) 2>&1` in #( *${as_nl}ac_space=\ *) # `set' does not quote correctly, so add quotes: double-quote # substitution turns \\\\ into \\, and sed turns \\ into \. sed -n \ "s/'/'\\\\''/g; s/^\\([_$as_cr_alnum]*_cv_[_$as_cr_alnum]*\\)=\\(.*\\)/\\1='\\2'/p" ;; #( *) # `set' quotes correctly as required by POSIX, so do not add quotes. sed -n "/^[_$as_cr_alnum]*_cv_[_$as_cr_alnum]*=/p" ;; esac | sort ) | sed ' /^ac_cv_env_/b end t clear :clear s/^\([^=]*\)=\(.*[{}].*\)$/test "${\1+set}" = set || &/ t end s/^\([^=]*\)=\(.*\)$/\1=${\1=\2}/ :end' >>confcache if diff "$cache_file" confcache >/dev/null 2>&1; then :; else if test -w "$cache_file"; then if test "x$cache_file" != "x/dev/null"; then { $as_echo "$as_me:${as_lineno-$LINENO}: updating cache $cache_file" >&5 $as_echo "$as_me: updating cache $cache_file" >&6;} if test ! -f "$cache_file" || test -h "$cache_file"; then cat confcache >"$cache_file" else case $cache_file in #( */* | ?:*) mv -f confcache "$cache_file"$$ && mv -f "$cache_file"$$ "$cache_file" ;; #( *) mv -f confcache "$cache_file" ;; esac fi fi else { $as_echo "$as_me:${as_lineno-$LINENO}: not updating unwritable cache $cache_file" >&5 $as_echo "$as_me: not updating unwritable cache $cache_file" >&6;} fi fi rm -f confcache test "x$prefix" = xNONE && prefix=$ac_default_prefix # Let make expand exec_prefix. test "x$exec_prefix" = xNONE && exec_prefix='${prefix}' # Transform confdefs.h into DEFS. # Protect against shell expansion while executing Makefile rules. # Protect against Makefile macro expansion. # # If the first sed substitution is executed (which looks for macros that # take arguments), then branch to the quote section. Otherwise, # look for a macro that doesn't take arguments. ac_script=' :mline /\\$/{ N s,\\\n,, b mline } t clear :clear s/^[ ]*#[ ]*define[ ][ ]*\([^ (][^ (]*([^)]*)\)[ ]*\(.*\)/-D\1=\2/g t quote s/^[ ]*#[ ]*define[ ][ ]*\([^ ][^ ]*\)[ ]*\(.*\)/-D\1=\2/g t quote b any :quote s/[ `~#$^&*(){}\\|;'\''"<>?]/\\&/g s/\[/\\&/g s/\]/\\&/g s/\$/$$/g H :any ${ g s/^\n// s/\n/ /g p } ' DEFS=`sed -n "$ac_script" confdefs.h` ac_libobjs= ac_ltlibobjs= U= for ac_i in : $LIBOBJS; do test "x$ac_i" = x: && continue # 1. Remove the extension, and $U if already installed. ac_script='s/\$U\././;s/\.o$//;s/\.obj$//' ac_i=`$as_echo "$ac_i" | sed "$ac_script"` # 2. Prepend LIBOBJDIR. When used with automake>=1.10 LIBOBJDIR # will be set to the directory where LIBOBJS objects are built. as_fn_append ac_libobjs " \${LIBOBJDIR}$ac_i\$U.$ac_objext" as_fn_append ac_ltlibobjs " \${LIBOBJDIR}$ac_i"'$U.lo' done LIBOBJS=$ac_libobjs LTLIBOBJS=$ac_ltlibobjs : "${CONFIG_STATUS=./config.status}" ac_write_fail=0 ac_clean_files_save=$ac_clean_files ac_clean_files="$ac_clean_files $CONFIG_STATUS" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $CONFIG_STATUS" >&5 $as_echo "$as_me: creating $CONFIG_STATUS" >&6;} as_write_fail=0 cat >$CONFIG_STATUS <<_ASEOF || as_write_fail=1 #! $SHELL # Generated by $as_me. # Run this file to recreate the current configuration. # Compiler output produced by configure, useful for debugging # configure, is in config.log if it exists. debug=false ac_cs_recheck=false ac_cs_silent=false SHELL=\${CONFIG_SHELL-$SHELL} export SHELL _ASEOF cat >>$CONFIG_STATUS <<\_ASEOF || as_write_fail=1 ## -------------------- ## ## M4sh Initialization. ## ## -------------------- ## # Be more Bourne compatible DUALCASE=1; export DUALCASE # for MKS sh if test -n "${ZSH_VERSION+set}" && (emulate sh) >/dev/null 2>&1; then : emulate sh NULLCMD=: # Pre-4.2 versions of Zsh do word splitting on ${1+"$@"}, which # is contrary to our usage. Disable this feature. alias -g '${1+"$@"}'='"$@"' setopt NO_GLOB_SUBST else case `(set -o) 2>/dev/null` in #( *posix*) : set -o posix ;; #( *) : ;; esac fi as_nl=' ' export as_nl # Printing a long string crashes Solaris 7 /usr/bin/printf. as_echo='\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\' as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo as_echo=$as_echo$as_echo$as_echo$as_echo$as_echo$as_echo # Prefer a ksh shell builtin over an external printf program on Solaris, # but without wasting forks for bash or zsh. if test -z "$BASH_VERSION$ZSH_VERSION" \ && (test "X`print -r -- $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='print -r --' as_echo_n='print -rn --' elif (test "X`printf %s $as_echo`" = "X$as_echo") 2>/dev/null; then as_echo='printf %s\n' as_echo_n='printf %s' else if test "X`(/usr/ucb/echo -n -n $as_echo) 2>/dev/null`" = "X-n $as_echo"; then as_echo_body='eval /usr/ucb/echo -n "$1$as_nl"' as_echo_n='/usr/ucb/echo -n' else as_echo_body='eval expr "X$1" : "X\\(.*\\)"' as_echo_n_body='eval arg=$1; case $arg in #( *"$as_nl"*) expr "X$arg" : "X\\(.*\\)$as_nl"; arg=`expr "X$arg" : ".*$as_nl\\(.*\\)"`;; esac; expr "X$arg" : "X\\(.*\\)" | tr -d "$as_nl" ' export as_echo_n_body as_echo_n='sh -c $as_echo_n_body as_echo' fi export as_echo_body as_echo='sh -c $as_echo_body as_echo' fi # The user is always right. if test "${PATH_SEPARATOR+set}" != set; then PATH_SEPARATOR=: (PATH='/bin;/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 && { (PATH='/bin:/bin'; FPATH=$PATH; sh -c :) >/dev/null 2>&1 || PATH_SEPARATOR=';' } fi # IFS # We need space, tab and new line, in precisely that order. Quoting is # there to prevent editors from complaining about space-tab. # (If _AS_PATH_WALK were called with IFS unset, it would disable word # splitting by setting IFS to empty value.) IFS=" "" $as_nl" # Find who we are. Look in the path if we contain no directory separator. as_myself= case $0 in #(( *[\\/]* ) as_myself=$0 ;; *) as_save_IFS=$IFS; IFS=$PATH_SEPARATOR for as_dir in $PATH do IFS=$as_save_IFS test -z "$as_dir" && as_dir=. test -r "$as_dir/$0" && as_myself=$as_dir/$0 && break done IFS=$as_save_IFS ;; esac # We did not find ourselves, most probably we were run as `sh COMMAND' # in which case we are not to be found in the path. if test "x$as_myself" = x; then as_myself=$0 fi if test ! -f "$as_myself"; then $as_echo "$as_myself: error: cannot find myself; rerun with an absolute file name" >&2 exit 1 fi # Unset variables that we do not need and which cause bugs (e.g. in # pre-3.0 UWIN ksh). But do not cause bugs in bash 2.01; the "|| exit 1" # suppresses any "Segmentation fault" message there. '((' could # trigger a bug in pdksh 5.2.14. for as_var in BASH_ENV ENV MAIL MAILPATH do eval test x\${$as_var+set} = xset \ && ( (unset $as_var) || exit 1) >/dev/null 2>&1 && unset $as_var || : done PS1='$ ' PS2='> ' PS4='+ ' # NLS nuisances. LC_ALL=C export LC_ALL LANGUAGE=C export LANGUAGE # CDPATH. (unset CDPATH) >/dev/null 2>&1 && unset CDPATH # as_fn_error STATUS ERROR [LINENO LOG_FD] # ---------------------------------------- # Output "`basename $0`: error: ERROR" to stderr. If LINENO and LOG_FD are # provided, also output the error to LOG_FD, referencing LINENO. Then exit the # script with STATUS, using 1 if that was 0. as_fn_error () { as_status=$1; test $as_status -eq 0 && as_status=1 if test "$4"; then as_lineno=${as_lineno-"$3"} as_lineno_stack=as_lineno_stack=$as_lineno_stack $as_echo "$as_me:${as_lineno-$LINENO}: error: $2" >&$4 fi $as_echo "$as_me: error: $2" >&2 as_fn_exit $as_status } # as_fn_error # as_fn_set_status STATUS # ----------------------- # Set $? to STATUS, without forking. as_fn_set_status () { return $1 } # as_fn_set_status # as_fn_exit STATUS # ----------------- # Exit the shell with STATUS, even in a "trap 0" or "set -e" context. as_fn_exit () { set +e as_fn_set_status $1 exit $1 } # as_fn_exit # as_fn_unset VAR # --------------- # Portably unset VAR. as_fn_unset () { { eval $1=; unset $1;} } as_unset=as_fn_unset # as_fn_append VAR VALUE # ---------------------- # Append the text in VALUE to the end of the definition contained in VAR. Take # advantage of any shell optimizations that allow amortized linear growth over # repeated appends, instead of the typical quadratic growth present in naive # implementations. if (eval "as_var=1; as_var+=2; test x\$as_var = x12") 2>/dev/null; then : eval 'as_fn_append () { eval $1+=\$2 }' else as_fn_append () { eval $1=\$$1\$2 } fi # as_fn_append # as_fn_arith ARG... # ------------------ # Perform arithmetic evaluation on the ARGs, and store the result in the # global $as_val. Take advantage of shells that can avoid forks. The arguments # must be portable across $(()) and expr. if (eval "test \$(( 1 + 1 )) = 2") 2>/dev/null; then : eval 'as_fn_arith () { as_val=$(( $* )) }' else as_fn_arith () { as_val=`expr "$@" || test $? -eq 1` } fi # as_fn_arith if expr a : '\(a\)' >/dev/null 2>&1 && test "X`expr 00001 : '.*\(...\)'`" = X001; then as_expr=expr else as_expr=false fi if (basename -- /) >/dev/null 2>&1 && test "X`basename -- / 2>&1`" = "X/"; then as_basename=basename else as_basename=false fi if (as_dir=`dirname -- /` && test "X$as_dir" = X/) >/dev/null 2>&1; then as_dirname=dirname else as_dirname=false fi as_me=`$as_basename -- "$0" || $as_expr X/"$0" : '.*/\([^/][^/]*\)/*$' \| \ X"$0" : 'X\(//\)$' \| \ X"$0" : 'X\(/\)' \| . 2>/dev/null || $as_echo X/"$0" | sed '/^.*\/\([^/][^/]*\)\/*$/{ s//\1/ q } /^X\/\(\/\/\)$/{ s//\1/ q } /^X\/\(\/\).*/{ s//\1/ q } s/.*/./; q'` # Avoid depending upon Character Ranges. as_cr_letters='abcdefghijklmnopqrstuvwxyz' as_cr_LETTERS='ABCDEFGHIJKLMNOPQRSTUVWXYZ' as_cr_Letters=$as_cr_letters$as_cr_LETTERS as_cr_digits='0123456789' as_cr_alnum=$as_cr_Letters$as_cr_digits ECHO_C= ECHO_N= ECHO_T= case `echo -n x` in #((((( -n*) case `echo 'xy\c'` in *c*) ECHO_T=' ';; # ECHO_T is single tab character. xy) ECHO_C='\c';; *) echo `echo ksh88 bug on AIX 6.1` > /dev/null ECHO_T=' ';; esac;; *) ECHO_N='-n';; esac rm -f conf$$ conf$$.exe conf$$.file if test -d conf$$.dir; then rm -f conf$$.dir/conf$$.file else rm -f conf$$.dir mkdir conf$$.dir 2>/dev/null fi if (echo >conf$$.file) 2>/dev/null; then if ln -s conf$$.file conf$$ 2>/dev/null; then as_ln_s='ln -s' # ... but there are two gotchas: # 1) On MSYS, both `ln -s file dir' and `ln file dir' fail. # 2) DJGPP < 2.04 has no symlinks; `ln -s' creates a wrapper executable. # In both cases, we have to default to `cp -pR'. ln -s conf$$.file conf$$.dir 2>/dev/null && test ! -f conf$$.exe || as_ln_s='cp -pR' elif ln conf$$.file conf$$ 2>/dev/null; then as_ln_s=ln else as_ln_s='cp -pR' fi else as_ln_s='cp -pR' fi rm -f conf$$ conf$$.exe conf$$.dir/conf$$.file conf$$.file rmdir conf$$.dir 2>/dev/null # as_fn_mkdir_p # ------------- # Create "$as_dir" as a directory, including parents if necessary. as_fn_mkdir_p () { case $as_dir in #( -*) as_dir=./$as_dir;; esac test -d "$as_dir" || eval $as_mkdir_p || { as_dirs= while :; do case $as_dir in #( *\'*) as_qdir=`$as_echo "$as_dir" | sed "s/'/'\\\\\\\\''/g"`;; #'( *) as_qdir=$as_dir;; esac as_dirs="'$as_qdir' $as_dirs" as_dir=`$as_dirname -- "$as_dir" || $as_expr X"$as_dir" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$as_dir" : 'X\(//\)[^/]' \| \ X"$as_dir" : 'X\(//\)$' \| \ X"$as_dir" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$as_dir" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` test -d "$as_dir" && break done test -z "$as_dirs" || eval "mkdir $as_dirs" } || test -d "$as_dir" || as_fn_error $? "cannot create directory $as_dir" } # as_fn_mkdir_p if mkdir -p . 2>/dev/null; then as_mkdir_p='mkdir -p "$as_dir"' else test -d ./-p && rmdir ./-p as_mkdir_p=false fi # as_fn_executable_p FILE # ----------------------- # Test if FILE is an executable regular file. as_fn_executable_p () { test -f "$1" && test -x "$1" } # as_fn_executable_p as_test_x='test -x' as_executable_p=as_fn_executable_p # Sed expression to map a string onto a valid CPP name. as_tr_cpp="eval sed 'y%*$as_cr_letters%P$as_cr_LETTERS%;s%[^_$as_cr_alnum]%_%g'" # Sed expression to map a string onto a valid variable name. as_tr_sh="eval sed 'y%*+%pp%;s%[^_$as_cr_alnum]%_%g'" exec 6>&1 ## ----------------------------------- ## ## Main body of $CONFIG_STATUS script. ## ## ----------------------------------- ## _ASEOF test $as_write_fail = 0 && chmod +x $CONFIG_STATUS || ac_write_fail=1 cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Save the log message, to keep $0 and so on meaningful, and to # report actual input values of CONFIG_FILES etc. instead of their # values after options handling. ac_log=" This file was extended by Makefile.in $as_me 1.0, which was generated by GNU Autoconf 2.69. Invocation command line was CONFIG_FILES = $CONFIG_FILES CONFIG_HEADERS = $CONFIG_HEADERS CONFIG_LINKS = $CONFIG_LINKS CONFIG_COMMANDS = $CONFIG_COMMANDS $ $0 $@ on `(hostname || uname -n) 2>/dev/null | sed 1q` " _ACEOF case $ac_config_files in *" "*) set x $ac_config_files; shift; ac_config_files=$*;; esac cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 # Files that config.status was made for. config_files="$ac_config_files" _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 ac_cs_usage="\ \`$as_me' instantiates files and other configuration actions from templates according to the current configuration. Unless the files and actions are specified as TAGs, all are instantiated by default. Usage: $0 [OPTION]... [TAG]... -h, --help print this help, then exit -V, --version print version number and configuration settings, then exit --config print configuration, then exit -q, --quiet, --silent do not print progress messages -d, --debug don't remove temporary files --recheck update $as_me by reconfiguring in the same conditions --file=FILE[:TEMPLATE] instantiate the configuration file FILE Configuration files: $config_files Report bugs to the package provider." _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_cs_config="`$as_echo "$ac_configure_args" | sed 's/^ //; s/[\\""\`\$]/\\\\&/g'`" ac_cs_version="\\ Makefile.in config.status 1.0 configured by $0, generated by GNU Autoconf 2.69, with options \\"\$ac_cs_config\\" Copyright (C) 2012 Free Software Foundation, Inc. This config.status script is free software; the Free Software Foundation gives unlimited permission to copy, distribute and modify it." ac_pwd='$ac_pwd' srcdir='$srcdir' test -n "\$AWK" || AWK=awk _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # The default lists apply if the user does not specify any file. ac_need_defaults=: while test $# != 0 do case $1 in --*=?*) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg=`expr "X$1" : 'X[^=]*=\(.*\)'` ac_shift=: ;; --*=) ac_option=`expr "X$1" : 'X\([^=]*\)='` ac_optarg= ac_shift=: ;; *) ac_option=$1 ac_optarg=$2 ac_shift=shift ;; esac case $ac_option in # Handling of the options. -recheck | --recheck | --rechec | --reche | --rech | --rec | --re | --r) ac_cs_recheck=: ;; --version | --versio | --versi | --vers | --ver | --ve | --v | -V ) $as_echo "$ac_cs_version"; exit ;; --config | --confi | --conf | --con | --co | --c ) $as_echo "$ac_cs_config"; exit ;; --debug | --debu | --deb | --de | --d | -d ) debug=: ;; --file | --fil | --fi | --f ) $ac_shift case $ac_optarg in *\'*) ac_optarg=`$as_echo "$ac_optarg" | sed "s/'/'\\\\\\\\''/g"` ;; '') as_fn_error $? "missing file argument" ;; esac as_fn_append CONFIG_FILES " '$ac_optarg'" ac_need_defaults=false;; --he | --h | --help | --hel | -h ) $as_echo "$ac_cs_usage"; exit ;; -q | -quiet | --quiet | --quie | --qui | --qu | --q \ | -silent | --silent | --silen | --sile | --sil | --si | --s) ac_cs_silent=: ;; # This is an error. -*) as_fn_error $? "unrecognized option: \`$1' Try \`$0 --help' for more information." ;; *) as_fn_append ac_config_targets " $1" ac_need_defaults=false ;; esac shift done ac_configure_extra_args= if $ac_cs_silent; then exec 6>/dev/null ac_configure_extra_args="$ac_configure_extra_args --silent" fi _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 if \$ac_cs_recheck; then set X $SHELL '$0' $ac_configure_args \$ac_configure_extra_args --no-create --no-recursion shift \$as_echo "running CONFIG_SHELL=$SHELL \$*" >&6 CONFIG_SHELL='$SHELL' export CONFIG_SHELL exec "\$@" fi _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 exec 5>>config.log { echo sed 'h;s/./-/g;s/^.../## /;s/...$/ ##/;p;x;p;x' <<_ASBOX ## Running $as_me. ## _ASBOX $as_echo "$ac_log" } >&5 _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # Handling of arguments. for ac_config_target in $ac_config_targets do case $ac_config_target in "Makefile") CONFIG_FILES="$CONFIG_FILES Makefile" ;; "debian/changelog") CONFIG_FILES="$CONFIG_FILES debian/changelog" ;; "debian/files") CONFIG_FILES="$CONFIG_FILES debian/files" ;; "debian/control") CONFIG_FILES="$CONFIG_FILES debian/control" ;; *) as_fn_error $? "invalid argument: \`$ac_config_target'" "$LINENO" 5;; esac done # If the user did not use the arguments to specify the items to instantiate, # then the envvar interface is used. Set only those that are not. # We use the long form for the default assignment because of an extremely # bizarre bug on SunOS 4.1.3. if $ac_need_defaults; then test "${CONFIG_FILES+set}" = set || CONFIG_FILES=$config_files fi # Have a temporary directory for convenience. Make it in the build tree # simply because there is no reason against having it here, and in addition, # creating and moving files from /tmp can sometimes cause problems. # Hook for its removal unless debugging. # Note that there is a small window in which the directory will not be cleaned: # after its creation but before its name has been assigned to `$tmp'. $debug || { tmp= ac_tmp= trap 'exit_status=$? : "${ac_tmp:=$tmp}" { test ! -d "$ac_tmp" || rm -fr "$ac_tmp"; } && exit $exit_status ' 0 trap 'as_fn_exit 1' 1 2 13 15 } # Create a (secure) tmp directory for tmp files. { tmp=`(umask 077 && mktemp -d "./confXXXXXX") 2>/dev/null` && test -d "$tmp" } || { tmp=./conf$$-$RANDOM (umask 077 && mkdir "$tmp") } || as_fn_error $? "cannot create a temporary directory in ." "$LINENO" 5 ac_tmp=$tmp # Set up the scripts for CONFIG_FILES section. # No need to generate them if there are no CONFIG_FILES. # This happens for instance with `./config.status config.h'. if test -n "$CONFIG_FILES"; then ac_cr=`echo X | tr X '\015'` # On cygwin, bash can eat \r inside `` if the user requested igncr. # But we know of no other shell where ac_cr would be empty at this # point, so we can use a bashism as a fallback. if test "x$ac_cr" = x; then eval ac_cr=\$\'\\r\' fi ac_cs_awk_cr=`$AWK 'BEGIN { print "a\rb" }' /dev/null` if test "$ac_cs_awk_cr" = "a${ac_cr}b"; then ac_cs_awk_cr='\\r' else ac_cs_awk_cr=$ac_cr fi echo 'BEGIN {' >"$ac_tmp/subs1.awk" && _ACEOF { echo "cat >conf$$subs.awk <<_ACEOF" && echo "$ac_subst_vars" | sed 's/.*/&!$&$ac_delim/' && echo "_ACEOF" } >conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_num=`echo "$ac_subst_vars" | grep -c '^'` ac_delim='%!_!# ' for ac_last_try in false false false false false :; do . ./conf$$subs.sh || as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 ac_delim_n=`sed -n "s/.*$ac_delim\$/X/p" conf$$subs.awk | grep -c X` if test $ac_delim_n = $ac_delim_num; then break elif $ac_last_try; then as_fn_error $? "could not make $CONFIG_STATUS" "$LINENO" 5 else ac_delim="$ac_delim!$ac_delim _$ac_delim!! " fi done rm -f conf$$subs.sh cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 cat >>"\$ac_tmp/subs1.awk" <<\\_ACAWK && _ACEOF sed -n ' h s/^/S["/; s/!.*/"]=/ p g s/^[^!]*!// :repl t repl s/'"$ac_delim"'$// t delim :nl h s/\(.\{148\}\)..*/\1/ t more1 s/["\\]/\\&/g; s/^/"/; s/$/\\n"\\/ p n b repl :more1 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t nl :delim h s/\(.\{148\}\)..*/\1/ t more2 s/["\\]/\\&/g; s/^/"/; s/$/"/ p b :more2 s/["\\]/\\&/g; s/^/"/; s/$/"\\/ p g s/.\{148\}// t delim ' >$CONFIG_STATUS || ac_write_fail=1 rm -f conf$$subs.awk cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 _ACAWK cat >>"\$ac_tmp/subs1.awk" <<_ACAWK && for (key in S) S_is_set[key] = 1 FS = "" } { line = $ 0 nfields = split(line, field, "@") substed = 0 len = length(field[1]) for (i = 2; i < nfields; i++) { key = field[i] keylen = length(key) if (S_is_set[key]) { value = S[key] line = substr(line, 1, len) "" value "" substr(line, len + keylen + 3) len += length(value) + length(field[++i]) substed = 1 } else len += 1 + keylen } print line } _ACAWK _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 if sed "s/$ac_cr//" < /dev/null > /dev/null 2>&1; then sed "s/$ac_cr\$//; s/$ac_cr/$ac_cs_awk_cr/g" else cat fi < "$ac_tmp/subs1.awk" > "$ac_tmp/subs.awk" \ || as_fn_error $? "could not setup config files machinery" "$LINENO" 5 _ACEOF # VPATH may cause trouble with some makes, so we remove sole $(srcdir), # ${srcdir} and @srcdir@ entries from VPATH if srcdir is ".", strip leading and # trailing colons and then remove the whole line if VPATH becomes empty # (actually we leave an empty line to preserve line numbers). if test "x$srcdir" = x.; then ac_vpsub='/^[ ]*VPATH[ ]*=[ ]*/{ h s/// s/^/:/ s/[ ]*$/:/ s/:\$(srcdir):/:/g s/:\${srcdir}:/:/g s/:@srcdir@:/:/g s/^:*// s/:*$// x s/\(=[ ]*\).*/\1/ G s/\n// s/^[^=]*=[ ]*$// }' fi cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 fi # test -n "$CONFIG_FILES" eval set X " :F $CONFIG_FILES " shift for ac_tag do case $ac_tag in :[FHLC]) ac_mode=$ac_tag; continue;; esac case $ac_mode$ac_tag in :[FHL]*:*);; :L* | :C*:*) as_fn_error $? "invalid tag \`$ac_tag'" "$LINENO" 5;; :[FH]-) ac_tag=-:-;; :[FH]*) ac_tag=$ac_tag:$ac_tag.in;; esac ac_save_IFS=$IFS IFS=: set x $ac_tag IFS=$ac_save_IFS shift ac_file=$1 shift case $ac_mode in :L) ac_source=$1;; :[FH]) ac_file_inputs= for ac_f do case $ac_f in -) ac_f="$ac_tmp/stdin";; *) # Look for the file first in the build tree, then in the source tree # (if the path is not absolute). The absolute path cannot be DOS-style, # because $ac_f cannot contain `:'. test -f "$ac_f" || case $ac_f in [\\/$]*) false;; *) test -f "$srcdir/$ac_f" && ac_f="$srcdir/$ac_f";; esac || as_fn_error 1 "cannot find input file: \`$ac_f'" "$LINENO" 5;; esac case $ac_f in *\'*) ac_f=`$as_echo "$ac_f" | sed "s/'/'\\\\\\\\''/g"`;; esac as_fn_append ac_file_inputs " '$ac_f'" done # Let's still pretend it is `configure' which instantiates (i.e., don't # use $as_me), people would be surprised to read: # /* config.h. Generated by config.status. */ configure_input='Generated from '` $as_echo "$*" | sed 's|^[^:]*/||;s|:[^:]*/|, |g' `' by configure.' if test x"$ac_file" != x-; then configure_input="$ac_file. $configure_input" { $as_echo "$as_me:${as_lineno-$LINENO}: creating $ac_file" >&5 $as_echo "$as_me: creating $ac_file" >&6;} fi # Neutralize special characters interpreted by sed in replacement strings. case $configure_input in #( *\&* | *\|* | *\\* ) ac_sed_conf_input=`$as_echo "$configure_input" | sed 's/[\\\\&|]/\\\\&/g'`;; #( *) ac_sed_conf_input=$configure_input;; esac case $ac_tag in *:-:* | *:-) cat >"$ac_tmp/stdin" \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; esac ;; esac ac_dir=`$as_dirname -- "$ac_file" || $as_expr X"$ac_file" : 'X\(.*[^/]\)//*[^/][^/]*/*$' \| \ X"$ac_file" : 'X\(//\)[^/]' \| \ X"$ac_file" : 'X\(//\)$' \| \ X"$ac_file" : 'X\(/\)' \| . 2>/dev/null || $as_echo X"$ac_file" | sed '/^X\(.*[^/]\)\/\/*[^/][^/]*\/*$/{ s//\1/ q } /^X\(\/\/\)[^/].*/{ s//\1/ q } /^X\(\/\/\)$/{ s//\1/ q } /^X\(\/\).*/{ s//\1/ q } s/.*/./; q'` as_dir="$ac_dir"; as_fn_mkdir_p ac_builddir=. case "$ac_dir" in .) ac_dir_suffix= ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_dir_suffix=/`$as_echo "$ac_dir" | sed 's|^\.[\\/]||'` # A ".." for each directory in $ac_dir_suffix. ac_top_builddir_sub=`$as_echo "$ac_dir_suffix" | sed 's|/[^\\/]*|/..|g;s|/||'` case $ac_top_builddir_sub in "") ac_top_builddir_sub=. ac_top_build_prefix= ;; *) ac_top_build_prefix=$ac_top_builddir_sub/ ;; esac ;; esac ac_abs_top_builddir=$ac_pwd ac_abs_builddir=$ac_pwd$ac_dir_suffix # for backward compatibility: ac_top_builddir=$ac_top_build_prefix case $srcdir in .) # We are building in place. ac_srcdir=. ac_top_srcdir=$ac_top_builddir_sub ac_abs_top_srcdir=$ac_pwd ;; [\\/]* | ?:[\\/]* ) # Absolute name. ac_srcdir=$srcdir$ac_dir_suffix; ac_top_srcdir=$srcdir ac_abs_top_srcdir=$srcdir ;; *) # Relative name. ac_srcdir=$ac_top_build_prefix$srcdir$ac_dir_suffix ac_top_srcdir=$ac_top_build_prefix$srcdir ac_abs_top_srcdir=$ac_pwd/$srcdir ;; esac ac_abs_srcdir=$ac_abs_top_srcdir$ac_dir_suffix case $ac_mode in :F) # # CONFIG_FILE # _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 # If the template does not know about datarootdir, expand it. # FIXME: This hack should be removed a few years after 2.60. ac_datarootdir_hack=; ac_datarootdir_seen= ac_sed_dataroot=' /datarootdir/ { p q } /@datadir@/p /@docdir@/p /@infodir@/p /@localedir@/p /@mandir@/p' case `eval "sed -n \"\$ac_sed_dataroot\" $ac_file_inputs"` in *datarootdir*) ac_datarootdir_seen=yes;; *@datadir@*|*@docdir@*|*@infodir@*|*@localedir@*|*@mandir@*) { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&5 $as_echo "$as_me: WARNING: $ac_file_inputs seems to ignore the --datarootdir setting" >&2;} _ACEOF cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_datarootdir_hack=' s&@datadir@&$datadir&g s&@docdir@&$docdir&g s&@infodir@&$infodir&g s&@localedir@&$localedir&g s&@mandir@&$mandir&g s&\\\${datarootdir}&$datarootdir&g' ;; esac _ACEOF # Neutralize VPATH when `$srcdir' = `.'. # Shell code in configure.ac might set extrasub. # FIXME: do we really want to maintain this feature? cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1 ac_sed_extra="$ac_vpsub $extrasub _ACEOF cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1 :t /@[a-zA-Z_][a-zA-Z_0-9]*@/!b s|@configure_input@|$ac_sed_conf_input|;t t s&@top_builddir@&$ac_top_builddir_sub&;t t s&@top_build_prefix@&$ac_top_build_prefix&;t t s&@srcdir@&$ac_srcdir&;t t s&@abs_srcdir@&$ac_abs_srcdir&;t t s&@top_srcdir@&$ac_top_srcdir&;t t s&@abs_top_srcdir@&$ac_abs_top_srcdir&;t t s&@builddir@&$ac_builddir&;t t s&@abs_builddir@&$ac_abs_builddir&;t t s&@abs_top_builddir@&$ac_abs_top_builddir&;t t $ac_datarootdir_hack " eval sed \"\$ac_sed_extra\" "$ac_file_inputs" | $AWK -f "$ac_tmp/subs.awk" \ >$ac_tmp/out || as_fn_error $? "could not create $ac_file" "$LINENO" 5 test -z "$ac_datarootdir_hack$ac_datarootdir_seen" && { ac_out=`sed -n '/\${datarootdir}/p' "$ac_tmp/out"`; test -n "$ac_out"; } && { ac_out=`sed -n '/^[ ]*datarootdir[ ]*:*=/p' \ "$ac_tmp/out"`; test -z "$ac_out"; } && { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&5 $as_echo "$as_me: WARNING: $ac_file contains a reference to the variable \`datarootdir' which seems to be undefined. Please make sure it is defined" >&2;} rm -f "$ac_tmp/stdin" case $ac_file in -) cat "$ac_tmp/out" && rm -f "$ac_tmp/out";; *) rm -f "$ac_file" && mv "$ac_tmp/out" "$ac_file";; esac \ || as_fn_error $? "could not create $ac_file" "$LINENO" 5 ;; esac done # for ac_tag as_fn_exit 0 _ACEOF ac_clean_files=$ac_clean_files_save test $ac_write_fail = 0 || as_fn_error $? "write failure creating $CONFIG_STATUS" "$LINENO" 5 # configure is writing to config.log, and then calls config.status. # config.status does its own redirection, appending to config.log. # Unfortunately, on DOS this fails, as config.log is still kept open # by configure, so config.status won't be able to write to it; its # output is simply discarded. So we exec the FD to /dev/null, # effectively closing config.log, so it can be properly (re)opened and # appended to by config.status. When coming back to configure, we # need to make the FD available again. if test "$no_create" != yes; then ac_cs_success=: ac_config_status_args= test "$silent" = yes && ac_config_status_args="$ac_config_status_args --quiet" exec 5>/dev/null $SHELL $CONFIG_STATUS $ac_config_status_args || ac_cs_success=false exec 5>>config.log # Use ||, not &&, to avoid exiting from the if with $? = 1, which # would make configure fail if this is the last instruction. $ac_cs_success || as_fn_exit 1 fi if test -n "$ac_unrecognized_opts" && test "$enable_option_checking" != no; then { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: unrecognized options: $ac_unrecognized_opts" >&5 $as_echo "$as_me: WARNING: unrecognized options: $ac_unrecognized_opts" >&2;} fi nDPI-2.2/packages/ubuntu/configure.in000066400000000000000000000013711321103654100175560ustar00rootroot00000000000000AC_INIT([Makefile.in], 1.0) NDPI_VERS=`cat ../../config.h | grep -w VERSION | cut -d \" -f 2` PFRING_VERS=`cat $HOME/PF_RING/kernel/linux/pf_ring.h | grep RING_VERSION | head -1 | cut -d '"' -f 2` SVN_RELEASE=`svn info ../.. | grep "^Revision"|cut -d " " -f 2` PFRING_SVN_RELEASE=`svn info $HOME/PF_RING | grep "^Revision"|cut -d " " -f 2` MACHINE=`uname -m` if test $MACHINE = "x86_64"; then EXTN="amd64" else EXTN="i386" fi DATE=`date -R` KERNEL=`uname -r` AC_SUBST(NDPI_VERS) AC_SUBST(PFRING_VERS) AC_SUBST(MACHINE) AC_SUBST(EXTN) AC_SUBST(DATE) AC_SUBST(KERNEL) AC_SUBST(SVN_RELEASE) AC_SUBST(PFRING_SVN_RELEASE) AC_CONFIG_FILES(Makefile) AC_CONFIG_FILES(debian/changelog) AC_CONFIG_FILES(debian/files) AC_CONFIG_FILES(debian/control) AC_OUTPUT nDPI-2.2/packages/ubuntu/debian/000077500000000000000000000000001321103654100164655ustar00rootroot00000000000000nDPI-2.2/packages/ubuntu/debian/COPYRIGHT000066400000000000000000000431101321103654100177570ustar00rootroot00000000000000 GNU GENERAL PUBLIC LICENSE Version 2, June 1991 Copyright (C) 1989, 1991 Free Software Foundation, Inc. 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Preamble The licenses for most software are designed to take away your freedom to share and change it. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change free software--to make sure the software is free for all its users. This General Public License applies to most of the Free Software Foundation's software and to any other program whose authors commit to using it. (Some other Free Software Foundation software is covered by the GNU Library General Public License instead.) You can apply it to your programs, too. When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for this service if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs; and that you know you can do these things. To protect your rights, we need to make restrictions that forbid anyone to deny you these rights or to ask you to surrender the rights. These restrictions translate to certain responsibilities for you if you distribute copies of the software, or if you modify it. For example, if you distribute copies of such a program, whether gratis or for a fee, you must give the recipients all the rights that you have. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights. We protect your rights with two steps: (1) copyright the software, and (2) offer you this license which gives you legal permission to copy, distribute and/or modify the software. Also, for each author's protection and ours, we want to make certain that everyone understands that there is no warranty for this free software. If the software is modified by someone else and passed on, we want its recipients to know that what they have is not the original, so that any problems introduced by others will not reflect on the original authors' reputations. Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all. The precise terms and conditions for copying, distribution and modification follow. GNU GENERAL PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. The "Program", below, refers to any such program or work, and a "work based on the Program" means either the Program or any derivative work under copyright law: that is to say, a work containing the Program or a portion of it, either verbatim or with modifications and/or translated into another language. (Hereinafter, translation is included without limitation in the term "modification".) Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program). Whether that is true depends on what the Program does. 1. You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this License and to the absence of any warranty; and give any other recipients of the Program a copy of this License along with the Program. You may charge a fee for the physical act of transferring a copy, and you may at your option offer warranty protection in exchange for a fee. 2. You may modify your copy or copies of the Program or any portion of it, thus forming a work based on the Program, and copy and distribute such modifications or work under the terms of Section 1 above, provided that you also meet all of these conditions: a) You must cause the modified files to carry prominent notices stating that you changed the files and the date of any change. b) You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License. c) If the modified program normally reads commands interactively when run, you must cause it, when started running for such interactive use in the most ordinary way, to print or display an announcement including an appropriate copyright notice and a notice that there is no warranty (or else, saying that you provide a warranty) and that users may redistribute the program under these conditions, and telling the user how to view a copy of this License. (Exception: if the Program itself is interactive but does not normally print such an announcement, your work based on the Program is not required to print an announcement.) These requirements apply to the modified work as a whole. If identifiable sections of that work are not derived from the Program, and can be reasonably considered independent and separate works in themselves, then this License, and its terms, do not apply to those sections when you distribute them as separate works. But when you distribute the same sections as part of a whole which is a work based on the Program, the distribution of the whole must be on the terms of this License, whose permissions for other licensees extend to the entire whole, and thus to each and every part regardless of who wrote it. Thus, it is not the intent of this section to claim rights or contest your rights to work written entirely by you; rather, the intent is to exercise the right to control the distribution of derivative or collective works based on the Program. In addition, mere aggregation of another work not based on the Program with the Program (or with a work based on the Program) on a volume of a storage or distribution medium does not bring the other work under the scope of this License. 3. You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for noncommercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program. If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances. It is not the purpose of this section to induce you to infringe any patents or other property right claims or to contest validity of any such claims; this section has the sole purpose of protecting the integrity of the free software distribution system, which is implemented by public license practices. Many people have made generous contributions to the wide range of software distributed through that system in reliance on consistent application of that system; it is up to the author/donor to decide if he or she is willing to distribute software through any other system and a licensee cannot impose that choice. This section is intended to make thoroughly clear what is believed to be a consequence of the rest of this License. 8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License. 9. The Free Software Foundation may publish revised and/or new versions of the General Public License from time to time. Such new versions will be similar in spirit to the present version, but may differ in detail to address new problems or concerns. Each version is given a distinguishing version number. If the Program specifies a version number of this License which applies to it and "any later version", you have the option of following the terms and conditions either of that version or of any later version published by the Free Software Foundation. If the Program does not specify a version number of this License, you may choose any version ever published by the Free Software Foundation. 10. If you wish to incorporate parts of the Program into other free programs whose distribution conditions are different, write to the author to ask for permission. For software which is copyrighted by the Free Software Foundation, write to the Free Software Foundation; we sometimes make exceptions for this. Our decision will be guided by the two goals of preserving the free status of all derivatives of our free software and of promoting the sharing and reuse of software generally. NO WARRANTY 11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. END OF TERMS AND CONDITIONS How to Apply These Terms to Your New Programs If you develop a new program, and you want it to be of the greatest possible use to the public, the best way to achieve this is to make it free software which everyone can redistribute and change under these terms. To do so, attach the following notices to the program. It is safest to attach them to the start of each source file to most effectively convey the exclusion of warranty; and each file should have at least the "copyright" line and a pointer to where the full notice is found. Copyright (C) This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA Also add information on how to contact you by electronic and paper mail. If the program is interactive, make it output a short notice like this when it starts in an interactive mode: Gnomovision version 69, Copyright (C) year name of author Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'. This is free software, and you are welcome to redistribute it under certain conditions; type `show c' for details. The hypothetical commands `show w' and `show c' should show the appropriate parts of the General Public License. Of course, the commands you use may be called something other than `show w' and `show c'; they could even be mouse-clicks or menu items--whatever suits your program. You should also get your employer (if you work as a programmer) or your school, if any, to sign a "copyright disclaimer" for the program, if necessary. Here is a sample; alter the names: Yoyodyne, Inc., hereby disclaims all copyright interest in the program `Gnomovision' (which makes passes at compilers) written by James Hacker. , 1 April 1989 Ty Coon, President of Vice This General Public License does not permit incorporating your program into proprietary programs. If your program is a subroutine library, you may consider it more useful to permit linking proprietary applications with the library. If this is what you want to do, use the GNU Library General Public License instead of this License. nDPI-2.2/packages/ubuntu/debian/README000066400000000000000000000001641321103654100173460ustar00rootroot00000000000000This directory contains the files needed to build the package named 'nprobe' for the Debian GNU/Linux distribution. nDPI-2.2/packages/ubuntu/debian/changelog.in000066400000000000000000000001701321103654100207420ustar00rootroot00000000000000ndpi (@NDPI_VERS@-@SVN_RELEASE@) stable; urgency=high * Last packaged version -- Luca Deri @DATE@ nDPI-2.2/packages/ubuntu/debian/compat000066400000000000000000000000021321103654100176630ustar00rootroot000000000000001 nDPI-2.2/packages/ubuntu/debian/conffiles000066400000000000000000000000001321103654100203460ustar00rootroot00000000000000nDPI-2.2/packages/ubuntu/debian/control.in000066400000000000000000000011211321103654100204700ustar00rootroot00000000000000Source: ndpi Section: free Priority: optional Maintainer: Luca Deri Standards-Version: @NDPI_VERSION@ Build-Depends: Build-Conflicts: Package: ndpi Architecture: @EXTN@ Depends: pfring (=@PFRING_VERS@-@PFRING_SVN_RELEASE@), libnuma Recommends: Suggests: Pre-Depends: Conflicts: Provides: Replaces: Description: A network probe. Package: ndpi-dev Section: libdevel Architecture: all Depends: ndpi (= ${binary:Version}), ${misc:Depends} Conflicts: Description: development library and header files for ndpi Headers, static libraries, and documentation for the ndpi library nDPI-2.2/packages/ubuntu/debian/dirs000066400000000000000000000000171321103654100173470ustar00rootroot00000000000000usr/local/ndpi nDPI-2.2/packages/ubuntu/debian/docs000066400000000000000000000000071321103654100173350ustar00rootroot00000000000000README nDPI-2.2/packages/ubuntu/debian/files.in000066400000000000000000000000521321103654100201140ustar00rootroot00000000000000ndpi_@NDPI_VERS@_@EXTN@.deb free optional nDPI-2.2/packages/ubuntu/debian/postinst000077500000000000000000000011051321103654100202730ustar00rootroot00000000000000#!/bin/sh -e case "$1" in configure) # continue below ;; abort-upgrade|abort-remove|abort-deconfigure) exit 0 ;; *) echo "postinst called with unknown argument \`$1'" >&2 exit 0 ;; esac umask 022 # Update shared libs echo "/usr/local/lib\n" > /etc/ld.so.conf.d/nprobe.conf echo "Rebuilding ld cache..." /sbin/ldconfig echo "Adding the nprobe startup script" update-rc.d nprobe defaults 93 >/dev/null echo "Making the /etc/nprobe directory..." mkdir -p /etc/nprobe/ echo "Making the /var/log/nprobe directory..." mkdir -p /var/log/nprobe exit 0 nDPI-2.2/packages/ubuntu/debian/postrm000066400000000000000000000002731321103654100177360ustar00rootroot00000000000000#!/bin/sh -e set -e #\/bin/rm /etc/ld.so.conf.d/nprobe.conf /sbin/ldconfig # Not needed: upstart does it if [ "$1" = "purge" ] ; then update-rc.d nprobe remove >/dev/null fi exit 0 nDPI-2.2/packages/ubuntu/debian/preinst000066400000000000000000000012301321103654100200700ustar00rootroot00000000000000#! /bin/sh # preinst script for nbox # # see: dh_installdeb(1) set -e # summary of how this script can be called: # * `install' # * `install' # * `upgrade' # * `abort-upgrade' case "$1" in install|upgrade) if test -f /usr/local/sbin/nprobe; then rm /usr/local/sbin/nprobe fi ;; abort-upgrade) ;; *) echo "preinst called with unknown argument \`$1'" >&2 exit 0 ;; esac # dh_installdeb will replace this with shell code automatically # generated by other debhelper scripts. exit 0 nDPI-2.2/packages/ubuntu/debian/prerm000077500000000000000000000004721321103654100175430ustar00rootroot00000000000000#!/bin/sh -e # Only shut the daemon down if we're really removing the package. If this is # an upgrade, we will instead do a restart in the postinst... this keeps nprobe # from being left shut down for a long time, which could pose problems. case "$1" in upgrade) ;; *) /etc/init.d/nprobe stop ;; esac exit 0nDPI-2.2/packages/ubuntu/debian/rules000077500000000000000000000022401321103654100175430ustar00rootroot00000000000000#!/usr/bin/make -f # Uncomment this to turn on verbose mode. # export DH_VERBOSE=1 # # debian/compat # We should use at least compatibility version 5 # but this requires the whole building process # to be remade and this is something we leave # to when we will have more time # http://www.tin.org/bin/man.cgi?section=7&topic=debhelper # package=ndpi build: build-stamp build-stamp: dh_testdir clean: dh_testdir dh_testroot dh_clean install: build dh_testdir dh_testroot dh_clean -k dh_installdirs # Build architecture-independent files here. binary-indep: build install # We have nothing to do by default. # Build architecture-dependent files here. binary-arch: build install dh_testdir dh_testroot dh_clean -k dh_installdirs dh_installinit dh_installman # install the files into debian/tmp. cp -r ./usr/ ./debian/tmp cp -r ./ndpi-dev/* ./debian/ndpi-dev/ -find ./debian/tmp -name .svn -exec /bin/rm -rf {} ';' -find ./debian/tmp -executable -type f |xargs strip dh_link dh_strip dh_compress dh_fixperms dh_installdeb dh_gencontrol dh_md5sums dh_builddeb binary: binary-indep binary-arch .PHONY: build clean binary-indep binary-arch binary install nDPI-2.2/src/000077500000000000000000000000001321103654100127325ustar00rootroot00000000000000nDPI-2.2/src/include/000077500000000000000000000000001321103654100143555ustar00rootroot00000000000000nDPI-2.2/src/include/Makefile.am000066400000000000000000000003511321103654100164100ustar00rootroot00000000000000library_includedir=$(includedir)/libndpi-@VERSION@/libndpi library_include_HEADERS = ndpi_api.h \ ndpi_define.h \ ndpi_typedefs.h \ ndpi_main.h \ ndpi_protocol_ids.h \ ndpi_protocols.h \ ndpi_win32.h \ ndpi_includes.h nDPI-2.2/src/include/ndpi_api.h000066400000000000000000000562541321103654100163250ustar00rootroot00000000000000/* * ndpi_api.h * * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_API_H__ #define __NDPI_API_H__ #include "ndpi_main.h" #ifdef __cplusplus extern "C" { #endif #define SIZEOF_ID_STRUCT (sizeof(struct ndpi_id_struct)) #define SIZEOF_FLOW_STRUCT (sizeof(struct ndpi_flow_struct)) #define NDPI_DETECTION_ONLY_IPV4 ( 1 << 0 ) #define NDPI_DETECTION_ONLY_IPV6 ( 1 << 1 ) #define ADD_TO_DETECTION_BITMASK 1 #define NO_ADD_TO_DETECTION_BITMASK 0 #define SAVE_DETECTION_BITMASK_AS_UNKNOWN 1 #define NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN 0 /** * Check if a string is encoded with punycode * ( https://tools.ietf.org/html/rfc3492 ) * * @par buff = pointer to the string to ckeck * @par len = len of the string * @return 1 if the string is punycoded; * else 0 * */ int check_punycode_string(char * buff , int len); /** * Get the size of the flow struct * * @return the size of the flow struct * */ u_int32_t ndpi_detection_get_sizeof_ndpi_flow_struct(void); /** * Get the size of the id struct * * @return the size of the id struct * */ u_int32_t ndpi_detection_get_sizeof_ndpi_id_struct(void); /** * nDPI personal allocation and free functions **/ void * ndpi_malloc(size_t size); void * ndpi_calloc(unsigned long count, size_t size); void * ndpi_realloc(void *ptr, size_t old_size, size_t new_size); char * ndpi_strdup(const char *s); void ndpi_free(void *ptr); void * ndpi_flow_malloc(size_t size); void ndpi_flow_free(void *ptr); /** * Search the first occurrence of substring -find- in -s- * The search is limited to the first -slen- characters of the string * * @par s = string to parse * @par find = string to match with -s- * @par slen = max length to match between -s- and -find- * @return a pointer to the beginning of the located substring; * NULL if the substring is not found * */ char* ndpi_strnstr(const char *s, const char *find, size_t slen); /** * Same as ndpi_strnstr but case insensitive * * @par s = string to parse * @par find = string to match with -s- * @par slen = max length to match between -s- and -find- * @return a pointer to the beginning of the located substring; * NULL if the substring is not found * */ char* ndpi_strncasestr(const char *s, const char *find, size_t slen); /** * Returns the nDPI protocol id for IP-based protocol detection * * @par ndpi_struct = the struct created for the protocol detection * @par pin = IP host address (MUST BE in network byte order): * See man(7) ip for details * @return the nDPI protocol ID * */ u_int16_t ndpi_network_ptree_match(struct ndpi_detection_module_struct *ndpi_struct, struct in_addr *pin); /** * Init single protocol match * * @par ndpi_mod = the struct created for the protocol detection * @par match = the struct passed to match the protocol * */ void ndpi_init_protocol_match(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_match *match); /** * Returns a new initialized detection module * * @return the initialized detection module * */ struct ndpi_detection_module_struct *ndpi_init_detection_module(void); /** * Frees the memory allocated in the specified flow * * @par flow = the flow to deallocate * */ void ndpi_free_flow(struct ndpi_flow_struct *flow); /** * Enables cache support. * In nDPI is used for some protocol (i.e. Skype) * * @par ndpi_mod = the struct created for the protocol detection * @par host = string for the host name * @par port = unsigned int for the port number * */ void ndpi_enable_cache(struct ndpi_detection_module_struct *ndpi_mod, char* host, u_int port); /** * Destroys the detection module * * @par ndpi_struct = the struct to clearing for the detection module * */ void ndpi_exit_detection_module(struct ndpi_detection_module_struct *ndpi_struct); /** * Sets a single protocol bitmask * This function does not increment the index of the callback_buffer * * @par label = string for the protocol name * @par ndpi_struct = the detection module * @par detection_bitmask = the protocol bitmask * @par idx = the index of the callback_buffer * @par func = function pointer of the protocol search * @par ndpi_selection_bitmask = the protocol selected bitmask * @par b_save_bitmask_unknow = if set as "true" save the detection bitmask as unknow * @par b_add_detection_bitmask = if set as "true" add the protocol bitmask to the detection bitmask * */ void ndpi_set_bitmask_protocol_detection(char *label, struct ndpi_detection_module_struct *ndpi_struct, const NDPI_PROTOCOL_BITMASK *detection_bitmask, const u_int32_t idx, u_int16_t ndpi_protocol_id, void (*func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow), const NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_bitmask, u_int8_t b_save_bitmask_unknow, u_int8_t b_add_detection_bitmask); /** * Sets the protocol bitmask2 * * @par ndpi_struct = the detection module * @par detection_bitmask = the protocol bitmask to set * */ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *ndpi_struct, const NDPI_PROTOCOL_BITMASK * detection_bitmask); /** * Function to be called before we give up with detection for a given flow. * This function reduces the NDPI_UNKNOWN_PROTOCOL detection * * @par ndpi_struct = the detection module * @par flow = the flow given for the detection module * @return the detected protocol even if the flow is not completed; * */ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); /** * Processes an extra packet in order to get more information for a given protocol * (like SSL getting both client and server certificate even if we already know after * seeing the client certificate what the protocol is) * * @par ndpi_struct = the detection module * @par flow = pointer to the connection state machine * @par packet = unsigned char pointer to the Layer 3 (IP header) * @par packetlen = the length of the packet * @par current_tick = the current timestamp for the packet * @par src = pointer to the source subscriber state machine * @par dst = pointer to the destination subscriber state machine * @return void * */ void ndpi_process_extra_packet(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const unsigned char *packet, const unsigned short packetlen, const u_int64_t current_tick, struct ndpi_id_struct *src, struct ndpi_id_struct *dst); /** * Processes one packet and returns the ID of the detected protocol. * This is the MAIN PACKET PROCESSING FUNCTION. * * @par ndpi_struct = the detection module * @par flow = pointer to the connection state machine * @par packet = unsigned char pointer to the Layer 3 (IP header) * @par packetlen = the length of the packet * @par current_tick = the current timestamp for the packet * @par src = pointer to the source subscriber state machine * @par dst = pointer to the destination subscriber state machine * @return the detected ID of the protocol * */ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const unsigned char *packet, const unsigned short packetlen, const u_int64_t current_tick, struct ndpi_id_struct *src, struct ndpi_id_struct *dst); /** * Get the main protocol of the passed flows for the detected module * * * @par ndpi_struct = the detection module * @par flow = the flow given for the detection module * @return the ID of the master protocol detected * */ u_int16_t ndpi_get_flow_masterprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); /** * Query the pointer to the layer 4 packet * * @par l3 = pointer to the layer 3 data * @par l3_len = length of the layer 3 data * @par l4_return = address to the pointer of the layer 4 data if return value == 0, else undefined * @par l4_len_return = length of the layer 4 data if return value == 0, else undefined * @par l4_protocol_return = protocol of the layer 4 data if return value == 0, undefined otherwise * @par flags = limit operation on ipv4 or ipv6 packets. Possible values: NDPI_DETECTION_ONLY_IPV4 - NDPI_DETECTION_ONLY_IPV6 - 0 (any) * @return 0 if layer 4 data could be found correctly; else != 0 * */ u_int8_t ndpi_detection_get_l4(const u_int8_t *l3, u_int16_t l3_len, const u_int8_t **l4_return, u_int16_t *l4_len_return, u_int8_t *l4_protocol_return, u_int32_t flags); /** * Search and return the protocol based on matched ports * * @par ndpi_struct = the detection module * @par shost = source address in host byte order * @par sport = source port number * @par dhost = destination address in host byte order * @par dport = destination port number * @return the struct ndpi_protocol that match the port base protocol * */ ndpi_protocol ndpi_find_port_based_protocol(struct ndpi_detection_module_struct *ndpi_struct/* , u_int8_t proto */, u_int32_t shost, u_int16_t sport, u_int32_t dhost, u_int16_t dport); /** * Search and return the protocol guessed that is undetected * * @par ndpi_struct = the detection module * @par proto = the l4 protocol number * @par shost = source address in host byte order * @par sport = source port number * @par dhost = destination address in host byte order * @par dport = destination port number * @return the struct ndpi_protocol that match the port base protocol * */ ndpi_protocol ndpi_guess_undetected_protocol(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t proto, u_int32_t shost, u_int16_t sport, u_int32_t dhost, u_int16_t dport); /** * Check if the string passed match with a protocol * * @par ndpi_struct = the detection module * @par string_to_match = the string to match * @par string_to_match_len = the length of the string * @par is_host_match = value of the second field of struct ndpi_automa * @return the ID of the matched subprotocol * */ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, char *string_to_match, u_int string_to_match_len, u_int8_t is_host_match); /** * Check if the host passed match with a protocol * * @par ndpi_struct = the detection module * @par flow = the flow where match the host * @par string_to_match = the string to match * @par string_to_match_len = the length of the string * @par master_protocol_id = value of the ID associated to the master protocol detected * @return the ID of the matched subprotocol * */ int ndpi_match_host_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *string_to_match, u_int string_to_match_len, u_int16_t master_protocol_id); /** * Check if the string content passed match with a protocol * * @par ndpi_struct = the detection module * @par flow = the flow where match the host * @par string_to_match = the string to match * @par string_to_match_len = the length of the string * @par master_protocol_id = value of the ID associated to the master protocol detected * @return the ID of the matched subprotocol * */ int ndpi_match_content_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *string_to_match, u_int string_to_match_len, u_int16_t master_protocol_id); /** * Check if the string -bigram_to_match- match with a bigram of -automa- * * @par ndpi_mod = the detection module * @par automa = the struct ndpi_automa for the bigram * @par bigram_to_match = the bigram string to match * @return 0 * */ int ndpi_match_bigram(struct ndpi_detection_module_struct *ndpi_mod, ndpi_automa *automa, char *bigram_to_match); /** * Write the protocol name in the buffer -buf- as master_protocol.protocol * * @par ndpi_mod = the detection module * @par proto = the struct ndpi_protocol contain the protocols name * @par buf = the buffer to write the name of the protocols * @par buf_len = the length of the buffer * @return the buffer contains the master_protocol and protocol name * */ char* ndpi_protocol2name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol proto, char *buf, u_int buf_len); /** * Find out if a given category is custom/user-defined * * @par category = the category associated to the protocol * @return 1 if this is a custom user category, 0 otherwise * */ int ndpi_is_custom_category(ndpi_protocol_category_t category); /** * Overwrite a protocol category defined by nDPI with the custom category * * @par ndpi_mod = the detection module * @par protoId = the protocol identifier to overwrite * @par breed = the breed to be associated to the protocol * */ void ndpi_set_proto_breed(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t protoId, ndpi_protocol_breed_t breed); /** * Overwrite a protocol category defined by nDPI with the custom category * * @par ndpi_mod = the detection module * @par protoId = the protocol identifier to overwrite * @par category = the category associated to the protocol * */ void ndpi_set_proto_category(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t protoId, ndpi_protocol_category_t protoCategory); /** * Check if subprotocols of the specified master protocol are just * informative (and not real) * * @par mod = the detection module * @par protoId = the (master) protocol identifier to query * @return 1 = the subprotocol is informative, 0 otherwise. * */ u_int8_t ndpi_is_subprotocol_informative(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t protoId); /** * Get protocol category as string * * @par mod = the detection module * @par category = the category associated to the protocol * @return the string name of the category * */ const char* ndpi_category_get_name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_category_t category); /** * Set protocol category string * * @par mod = the detection module * @par category = the category associated to the protocol * @paw name = the string name of the category * */ void ndpi_category_set_name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_category_t category, char *name); /** * Get protocol category * * @par ndpi_mod = the detection module * @par proto = the struct ndpi_protocol contain the protocols name * @return the protocol category */ ndpi_protocol_category_t ndpi_get_proto_category(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol proto); /** * Get the protocol name associated to the ID * * @par mod = the detection module * @par proto_id = the ID of the protocol * @return the buffer contains the master_protocol and protocol name * */ char* ndpi_get_proto_name(struct ndpi_detection_module_struct *mod, u_int16_t proto_id); /** * Return the protocol breed ID associated to the protocol * * @par ndpi_struct = the detection module * @par proto = the ID of the protocol * @return the breed ID associated to the protocol * */ ndpi_protocol_breed_t ndpi_get_proto_breed(struct ndpi_detection_module_struct *ndpi_struct, u_int16_t proto); /** * Return the string name of the protocol breed * * @par ndpi_struct = the detection module * @par breed_id = the breed ID associated to the protocol * @return the string name of the breed ID * */ char* ndpi_get_proto_breed_name(struct ndpi_detection_module_struct *ndpi_struct, ndpi_protocol_breed_t breed_id); /** * Return the ID of the protocol * * @par ndpi_mod = the detection module * @par proto = the ID of the protocol * @return the string name of the breed ID * */ int ndpi_get_protocol_id(struct ndpi_detection_module_struct *ndpi_mod, char *proto); /** * Write the list of the supported protocols * * @par ndpi_mod = the detection module */ void ndpi_dump_protocols(struct ndpi_detection_module_struct *mod); /** * Read a file and load the protocols * * Format: :,:,.....@ * * Example: * tcp:80,tcp:3128@HTTP * udp:139@NETBIOS * * @par ndpi_mod = the detection module * @par path = the path of the file * @return 0 if the file is loaded correctly; * -1 else * */ int ndpi_load_protocols_file(struct ndpi_detection_module_struct *ndpi_mod, char* path); /** * Get the total number of the supported protocols * * @par ndpi_mod = the detection module * @return the number of protocols * */ u_int ndpi_get_num_supported_protocols(struct ndpi_detection_module_struct *ndpi_mod); /** * Get the nDPI version release * * @return the NDPI_GIT_RELEASE * */ char* ndpi_revision(void); /** * Set the automa for the protocol search * * @par ndpi_struct = the detection module * @par automa = the automa to match * */ void ndpi_set_automa(struct ndpi_detection_module_struct *ndpi_struct, void* automa); #ifdef NDPI_PROTOCOL_HTTP /** * Retrieve information for HTTP flows * * @par ndpi_mod = the detection module * @par flow = the detected flow * @return the HTTP method information about the flow * */ ndpi_http_method ndpi_get_http_method(struct ndpi_detection_module_struct *ndpi_mod, struct ndpi_flow_struct *flow); /** * Get the HTTP url * * @par ndpi_mod = the detection module * @par flow = the detected flow * @return the HTTP method information about the flow * */ char* ndpi_get_http_url(struct ndpi_detection_module_struct *ndpi_mod, struct ndpi_flow_struct *flow); /** * Get the HTTP content-type * * @par ndpi_mod = the detection module * @par flow = the detected flow * @return the HTTP method information about the flow * */ char* ndpi_get_http_content_type(struct ndpi_detection_module_struct *ndpi_mod, struct ndpi_flow_struct *flow); #endif #ifdef NDPI_PROTOCOL_TOR /** * Check if the flow could be detected as TOR protocol * * @par ndpi_struct = the detection module * @par flow = the detected flow * @par certificate = the ssl certificate * @return 1 if the flow is TOR; * 0 else * */ int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *certificate); #endif /* Wrappers functions */ /** * Init Aho-Corasick automata * * @return The requested automata, or NULL if an error occurred * */ void* ndpi_init_automa(void); /** * Free Aho-Corasick automata allocated with ndpi_init_automa(); * * @par The automata initialized with ndpi_init_automa(); * */ void ndpi_free_automa(void *_automa); /** * Add a string to match to an automata * * @par The automata initialized with ndpi_init_automa(); * @par The (sub)string to search * @par The number associated with this string * @return 0 in case of no error, or -1 if an error occurred. * */ int ndpi_add_string_value_to_automa(void *_automa, char *str, unsigned long num); /** * Add a string to match to an automata. Same as ndpi_add_string_value_to_automa() with num set to 1 * * @par The automata initialized with ndpi_init_automa(); * @par The (sub)string to search * @return 0 in case of no error, or -1 if an error occurred. * */ int ndpi_add_string_to_automa(void *_automa, char *str); /** * Finalize the automa (necessary before start searching) * * @par The automata initialized with ndpi_init_automa(); * */ void ndpi_finalize_automa(void *_automa); /** * Add a string to match to an automata * * @par The automata initialized with ndpi_init_automa(); * @par The (sub)string to search * @return 0 in case of match, or -1 if no match, or -2 if an error occurred. * */ int ndpi_match_string(void *_automa, char *string_to_match); /** * Add a string to match to an automata * * @par The automata initialized with ndpi_init_automa(); * @par The (sub)string to search * @par The id associated with the matched string or 0 id not found. * @return 0 in case of match, or -1 if no match, or -2 if an error occurred. * */ int ndpi_match_string_id(void *_automa, char *string_to_match, unsigned long *id); /* Utility functions to set ndpi malloc/free/print wrappers */ void set_ndpi_malloc(void* (*__ndpi_malloc)(size_t size)); void set_ndpi_free(void (*__ndpi_free)(void *ptr)); void set_ndpi_flow_malloc(void* (*__ndpi_flow_malloc)(size_t size)); void set_ndpi_flow_free(void (*__ndpi_flow_free)(void *ptr)); void set_ndpi_debug_function(struct ndpi_detection_module_struct *ndpi_str, ndpi_debug_function_ptr ndpi_debug_printf); #ifdef __cplusplus } #endif #endif /* __NDPI_API_H__ */ nDPI-2.2/src/include/ndpi_define.h.in000066400000000000000000000353101321103654100174010ustar00rootroot00000000000000/* * * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_DEFINE_INCLUDE_FILE__ #define __NDPI_DEFINE_INCLUDE_FILE__ /* gcc -E -dM - < /dev/null |grep ENDIAN */ #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) #include #endif #ifdef __OpenBSD__ #include #define __BYTE_ORDER BYTE_ORDER #if BYTE_ORDER == LITTLE_ENDIAN #define __LITTLE_ENDIAN__ #else #define __BIG_ENDIAN__ #endif/* BYTE_ORDER */ #endif/* __OPENBSD__ */ #if __BYTE_ORDER == __LITTLE_ENDIAN #ifndef __LITTLE_ENDIAN__ #define __LITTLE_ENDIAN__ #endif #else #ifndef __BIG_ENDIAN__ #define __BIG_ENDIAN__ #endif #endif #ifdef WIN32 #ifndef __LITTLE_ENDIAN__ #define __LITTLE_ENDIAN__ 1 #endif #endif #if !(defined(__LITTLE_ENDIAN__) || defined(__BIG_ENDIAN__)) #if defined(__mips__) #undef __LITTLE_ENDIAN__ #undef __LITTLE_ENDIAN #define __BIG_ENDIAN__ #endif /* Everything else */ #if (defined(__BYTE_ORDER__) && defined(__ORDER_LITTLE_ENDIAN__)) #if __BYTE_ORDER__ == __ORDER_LITTLE_ENDIAN__ #define __LITTLE_ENDIAN__ #else #define __BIG_ENDIAN__ #endif #endif #endif #define NDPI_USE_ASYMMETRIC_DETECTION 0 #define NDPI_SELECTION_BITMASK_PROTOCOL_SIZE u_int32_t #define NDPI_SELECTION_BITMASK_PROTOCOL_IP (1<<0) #define NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP (1<<1) #define NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP (1<<2) #define NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP (1<<3) #define NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD (1<<4) #define NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION (1<<5) #define NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 (1<<6) #define NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 (1<<7) #define NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC (1<<8) /* now combined detections */ /* v4 */ #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP (NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP) #define NDPI_SELECTION_BITMASK_PROTOCOL_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP) #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP) /* v6 */ #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP) /* v4 or v6 */ #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP (NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP) #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) /* does it make sense to talk about udp with payload ??? have you ever seen empty udp packets ? */ #define NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION) #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION) #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) #define NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION (NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION | NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) /* safe src/dst protocol check macros... */ #define NDPI_SRC_HAS_PROTOCOL(src,protocol) ((src) != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK((src)->detected_protocol_bitmask,(protocol)) != 0) #define NDPI_DST_HAS_PROTOCOL(dst,protocol) ((dst) != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK((dst)->detected_protocol_bitmask,(protocol)) != 0) #define NDPI_SRC_OR_DST_HAS_PROTOCOL(src,dst,protocol) (NDPI_SRC_HAS_PROTOCOL(src,protocol) || NDPI_SRC_HAS_PROTOCOL(dst,protocol)) /** * convenience macro to check for excluded protocol * a protocol is excluded if the flow is known and either the protocol is not detected at all * or the excluded bitmask contains the protocol */ #define NDPI_FLOW_PROTOCOL_EXCLUDED(ndpi_struct,flow,protocol) ((flow) != NULL && \ ( NDPI_COMPARE_PROTOCOL_TO_BITMASK((ndpi_struct)->detection_bitmask, (protocol)) == 0 || \ NDPI_COMPARE_PROTOCOL_TO_BITMASK((flow)->excluded_protocol_bitmask, (protocol)) != 0 ) ) /* misc definitions */ #define NDPI_DEFAULT_MAX_TCP_RETRANSMISSION_WINDOW_SIZE 0x10000 /* TODO: rebuild all memory areas to have a more aligned memory block here */ /* DEFINITION OF MAX LINE NUMBERS FOR line parse algorithm */ #define NDPI_MAX_PARSE_LINES_PER_PACKET 64 #define MAX_PACKET_COUNTER 65000 #define MAX_DEFAULT_PORTS 5 #define NDPI_DIRECTCONNECT_CONNECTION_IP_TICK_TIMEOUT 600 #define NDPI_IRC_CONNECTION_TIMEOUT 120 #define NDPI_GNUTELLA_CONNECTION_TIMEOUT 60 #define NDPI_BATTLEFIELD_CONNECTION_TIMEOUT 60 #define NDPI_THUNDER_CONNECTION_TIMEOUT 30 #define NDPI_RTSP_CONNECTION_TIMEOUT 5 #define NDPI_TVANTS_CONNECTION_TIMEOUT 5 #define NDPI_YAHOO_DETECT_HTTP_CONNECTIONS 1 #define NDPI_YAHOO_LAN_VIDEO_TIMEOUT 30 #define NDPI_ZATTOO_CONNECTION_TIMEOUT 120 #define NDPI_ZATTOO_FLASH_TIMEOUT 5 #define NDPI_JABBER_STUN_TIMEOUT 30 #define NDPI_JABBER_FT_TIMEOUT 5 #define NDPI_SOULSEEK_CONNECTION_IP_TICK_TIMEOUT 600 #ifdef NDPI_ENABLE_DEBUG_MESSAGES #define NDPI_LOG(proto, m, log_level, args...) \ { \ struct ndpi_detection_module_struct *mod = (struct ndpi_detection_module_struct*) m; \ if(mod != NULL) { \ mod->ndpi_debug_print_file=__FILE__; \ mod->ndpi_debug_print_function=__FUNCTION__; \ mod->ndpi_debug_print_line=__LINE__; \ (*(mod->ndpi_debug_printf))(proto, mod, log_level, args); \ } \ } #else /* NDPI_ENABLE_DEBUG_MESSAGES */ #ifdef WIN32 #define NDPI_LOG(...) {} #else #define NDPI_LOG(proto, mod, log_level, args...) {} #endif #endif /* NDPI_ENABLE_DEBUG_MESSAGES */ /** * macro for getting the string len of a static string * * use it instead of strlen to avoid runtime calculations */ #define NDPI_STATICSTRING_LEN( s ) ( sizeof( s ) - 1 ) /** macro to compare 2 IPv6 addresses with each other to identify the "smaller" IPv6 address */ #define NDPI_COMPARE_IPV6_ADDRESS_STRUCTS(x,y) \ ((((u_int64_t *)(x))[0]) < (((u_int64_t *)(y))[0]) || ( (((u_int64_t *)(x))[0]) == (((u_int64_t *)(y))[0]) && (((u_int64_t *)(x))[1]) < (((u_int64_t *)(y))[1])) ) #define NDPI_NUM_BITS 256 #define NDPI_BITS /* 32 */ (sizeof(ndpi_ndpi_mask) * 8 /* number of bits in a byte */) /* bits per mask */ #define howmanybits(x, y) (((x)+((y)-1))/(y)) #define NDPI_SET(p, n) ((p)->fds_bits[(n)/NDPI_BITS] |= (1ul << (((u_int32_t)n) % NDPI_BITS))) #define NDPI_CLR(p, n) ((p)->fds_bits[(n)/NDPI_BITS] &= ~(1ul << (((u_int32_t)n) % NDPI_BITS))) #define NDPI_ISSET(p, n) ((p)->fds_bits[(n)/NDPI_BITS] & (1ul << (((u_int32_t)n) % NDPI_BITS))) #define NDPI_ZERO(p) memset((char *)(p), 0, sizeof(*(p))) #define NDPI_ONE(p) memset((char *)(p), 0xFF, sizeof(*(p))) #define NDPI_NUM_FDS_BITS howmanybits(NDPI_NUM_BITS, NDPI_BITS) #define NDPI_PROTOCOL_BITMASK ndpi_protocol_bitmask_struct_t #define NDPI_BITMASK_ADD(a,b) NDPI_SET(&a,b) #define NDPI_BITMASK_DEL(a,b) NDPI_CLR(&a,b) #define NDPI_BITMASK_RESET(a) NDPI_ZERO(&a) #define NDPI_BITMASK_SET_ALL(a) NDPI_ONE(&a) #define NDPI_BITMASK_SET(a, b) { memcpy(&a, &b, sizeof(NDPI_PROTOCOL_BITMASK)); } /* this is a very very tricky macro *g*, * the compiler will remove all shifts here if the protocol is static... */ #define NDPI_ADD_PROTOCOL_TO_BITMASK(bmask,value) NDPI_SET(&bmask,value) #define NDPI_DEL_PROTOCOL_FROM_BITMASK(bmask,value) NDPI_CLR(&bmask,value) #define NDPI_COMPARE_PROTOCOL_TO_BITMASK(bmask,value) NDPI_ISSET(&bmask,value) #define NDPI_SAVE_AS_BITMASK(bmask,value) { NDPI_ZERO(&bmask) ; NDPI_ADD_PROTOCOL_TO_BITMASK(bmask, value); } #define ndpi_min(a,b) ((a < b) ? a : b) #define ndpi_max(a,b) ((a > b) ? a : b) #define NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct,flow,packet) \ if (packet->packet_lines_parsed_complete != 1) { \ ndpi_parse_packet_line_info(ndpi_struct,flow); \ } \ #define NDPI_IPSEC_PROTOCOL_ESP 50 #define NDPI_IPSEC_PROTOCOL_AH 51 #define NDPI_GRE_PROTOCOL_TYPE 0x2F #define NDPI_ICMP_PROTOCOL_TYPE 0x01 #define NDPI_IGMP_PROTOCOL_TYPE 0x02 #define NDPI_EGP_PROTOCOL_TYPE 0x08 #define NDPI_OSPF_PROTOCOL_TYPE 0x59 #define NDPI_SCTP_PROTOCOL_TYPE 132 #define NDPI_IPIP_PROTOCOL_TYPE 0x04 #define NDPI_ICMPV6_PROTOCOL_TYPE 0x3a /* the get_uXX will return raw network packet bytes !! */ #define get_u_int8_t(X,O) (*(u_int8_t *)(((u_int8_t *)X) + O)) #define get_u_int16_t(X,O) (*(u_int16_t *)(((u_int8_t *)X) + O)) #define get_u_int32_t(X,O) (*(u_int32_t *)(((u_int8_t *)X) + O)) #define get_u_int64_t(X,O) (*(u_int64_t *)(((u_int8_t *)X) + O)) /* new definitions to get little endian from network bytes */ #define get_ul8(X,O) get_u_int8_t(X,O) #if defined(__LITTLE_ENDIAN__) || defined(_LITTLE_ENDIAN) #define get_l16(X,O) get_u_int16_t(X,O) #define get_l32(X,O) get_u_int32_t(X,O) #elif defined(__BIG_ENDIAN__) || defined(__BIG_ENDIAN) /* convert the bytes from big to little endian */ # define get_l16(X,O) bswap_16(get_u_int16_t(X,O)) # define get_l32(X,O) bswap_32(get_u_int32_t(X,O)) #else #error "__BYTE_ORDER MUST BE DEFINED !" #endif /* __BYTE_ORDER */ /* define memory callback function */ #define match_first_bytes(payload,st) (memcmp((payload),(st),(sizeof(st)-1))==0) #if defined(WIN32) && !defined(snprintf) #define snprintf _snprintf #endif #define NDPI_MAX_DNS_REQUESTS 16 #define NDPI_MAJOR @NDPI_MAJOR@ #define NDPI_MINOR @NDPI_MINOR@ #define NDPI_PATCH @NDPI_PATCH@ #endif /* __NDPI_DEFINE_INCLUDE_FILE__ */ nDPI-2.2/src/include/ndpi_includes.h000066400000000000000000000033341321103654100173510ustar00rootroot00000000000000/* * ndpi_includes.h * * Copyright (C) 2011-16 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_INCLUDES_H__ #define __NDPI_INCLUDES_H__ #include #include #include #include #include #include #include #ifdef WIN32 #include "ndpi_win32.h" #else #include #include #include #include #include #include #include #include #include #include #if !defined __APPLE__ && !defined __FreeBSD__ && !defined __NetBSD__ && !defined __OpenBSD__ #include #include #if defined __FreeBSD__ || defined __NetBSD__ || defined __OpenBSD__ #include #if defined __NetBSD__ || defined __OpenBSD__ #include #ifdef __OpenBSD__ #include #endif #endif #endif #endif #endif /* Win32 */ #endif /* __NDPI_INCLUDES_H__ */ nDPI-2.2/src/include/ndpi_main.h000066400000000000000000000144061321103654100164710ustar00rootroot00000000000000/* * ndpi_main.h * * Copyright (C) 2011-16 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_MAIN_H__ #define __NDPI_MAIN_H__ #include "ndpi_includes.h" #include "ndpi_define.h" #include "ndpi_protocol_ids.h" #include "ndpi_typedefs.h" #include "ndpi_api.h" #include "ndpi_protocols.h" #ifdef __cplusplus extern "C" { #endif void *ndpi_tdelete(const void * __restrict, void ** __restrict, int (*)(const void *, const void *)); void *ndpi_tfind(const void *, void *, int (*)(const void *, const void *)); void *ndpi_tsearch(const void *, void**, int (*)(const void *, const void *)); void ndpi_twalk(const void *, void (*)(const void *, ndpi_VISIT, int, void*), void *user_data); void ndpi_tdestroy(void *vrootp, void (*freefct)(void *)); int NDPI_BITMASK_COMPARE(NDPI_PROTOCOL_BITMASK a, NDPI_PROTOCOL_BITMASK b); int NDPI_BITMASK_IS_EMPTY(NDPI_PROTOCOL_BITMASK a); void NDPI_DUMP_BITMASK(NDPI_PROTOCOL_BITMASK a); extern u_int8_t ndpi_net_match(u_int32_t ip_to_check, u_int32_t net, u_int32_t num_bits); extern u_int8_t ndpi_ips_match(u_int32_t src, u_int32_t dst, u_int32_t net, u_int32_t num_bits); u_int16_t ntohs_ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read); u_int32_t ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read); u_int64_t ndpi_bytestream_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read); u_int32_t ndpi_bytestream_dec_or_hex_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read); u_int64_t ndpi_bytestream_dec_or_hex_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read); u_int32_t ndpi_bytestream_to_ipv4(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read); void ndpi_set_detected_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t upper_detected_protocol, u_int16_t lower_detected_protocol); extern void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); extern void ndpi_parse_packet_line_info_any(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); extern u_int16_t ndpi_check_for_email_address(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t counter); extern void ndpi_int_change_packet_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t upper_detected_protocol, u_int16_t lower_detected_protocol); extern void ndpi_int_change_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t upper_detected_protocol, u_int16_t lower_detected_protocol); extern void ndpi_set_proto_defaults(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_breed_t protoBreed, u_int16_t protoId, u_int16_t tcp_alias_protoId[2], u_int16_t udp_alias_protoId[2], char *protoName, ndpi_protocol_category_t protoCategory, ndpi_port_range *tcpDefPorts, ndpi_port_range *udpDefPorts); extern void ndpi_int_reset_packet_protocol(struct ndpi_packet_struct *packet); extern void ndpi_int_reset_protocol(struct ndpi_flow_struct *flow); extern int ndpi_packet_src_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip); extern int ndpi_packet_dst_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip); extern void ndpi_packet_src_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip); extern void ndpi_packet_dst_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip); extern char *ndpi_get_ip_string(struct ndpi_detection_module_struct *ndpi_struct, const ndpi_ip_addr_t * ip); extern char *ndpi_get_packet_src_ip_string(struct ndpi_detection_module_struct *ndpi_struct, const struct ndpi_packet_struct *packet); extern char* ndpi_get_proto_by_id(struct ndpi_detection_module_struct *ndpi_mod, u_int id); u_int16_t ndpi_get_proto_by_name(struct ndpi_detection_module_struct *ndpi_mod, const char *name); extern u_int16_t ndpi_guess_protocol_id(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t proto, u_int16_t sport, u_int16_t dport, u_int8_t *user_defined_proto); extern u_int8_t ndpi_is_proto(ndpi_protocol p, u_int16_t proto); extern u_int16_t ndpi_get_lower_proto(ndpi_protocol p); extern int ndpi_get_protocol_id_master_proto(struct ndpi_detection_module_struct *ndpi_struct, u_int16_t protocol_id, u_int16_t** tcp_master_proto, u_int16_t** udp_master_proto); #ifdef NDPI_PROTOCOL_NETBIOS int ndpi_netbios_name_interpret(char *in, char *out, u_int out_len); #endif #ifdef NDPI_ENABLE_DEBUG_MESSAGES void ndpi_debug_get_last_log_function_line(struct ndpi_detection_module_struct *ndpi_struct, const char **file, const char **func, u_int32_t * line); #endif /** Checks when the @p payload starts with the string literal @p str. * When the string is larger than the payload, check fails. * @return non-zero if check succeeded */ int ndpi_match_prefix(const u_int8_t *payload, size_t payload_len, const char *str, size_t str_len); /* version of ndpi_match_prefix with string literal */ #define ndpi_match_strprefix(payload, payload_len, str) \ ndpi_match_prefix((payload), (payload_len), (str), (sizeof(str)-1)) #ifdef __cplusplus } #endif #endif /* __NDPI_MAIN_H__ */ nDPI-2.2/src/include/ndpi_protocol_ids.h000066400000000000000000000346161321103654100202520ustar00rootroot00000000000000 /* * ndpi_protocol_ids.h * * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_API_H__ #endif #ifndef __NDPI_PROTOCOLS_DEFAULT_H__ #define __NDPI_PROTOCOLS_DEFAULT_H__ #define NDPI_DETECTION_SUPPORT_IPV6 #define NDPI_PROTOCOL_SIZE 2 #define NDPI_PROTOCOL_UNKNOWN 0 #define NDPI_PROTOCOL_NO_MASTER_PROTO NDPI_PROTOCOL_UNKNOWN #define NDPI_PROTOCOL_UNKNOWN 0 #define NDPI_PROTOCOL_FTP_CONTROL 1 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_MAIL_POP 2 #define NDPI_PROTOCOL_MAIL_SMTP 3 #define NDPI_PROTOCOL_MAIL_IMAP 4 #define NDPI_PROTOCOL_DNS 5 #define NDPI_PROTOCOL_IPP 6 #define NDPI_PROTOCOL_HTTP 7 #define NDPI_PROTOCOL_MDNS 8 #define NDPI_PROTOCOL_NTP 9 #define NDPI_PROTOCOL_NETBIOS 10 #define NDPI_PROTOCOL_NFS 11 #define NDPI_PROTOCOL_SSDP 12 #define NDPI_PROTOCOL_BGP 13 #define NDPI_PROTOCOL_SNMP 14 #define NDPI_PROTOCOL_XDMCP 15 #define NDPI_PROTOCOL_SMB 16 #define NDPI_PROTOCOL_SYSLOG 17 #define NDPI_PROTOCOL_DHCP 18 #define NDPI_PROTOCOL_POSTGRES 19 #define NDPI_PROTOCOL_MYSQL 20 #define NDPI_PROTOCOL_HOTMAIL 21 #define NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK 22 #define NDPI_PROTOCOL_MAIL_POPS 23 #define NDPI_PROTOCOL_APPLEJUICE 24 #define NDPI_PROTOCOL_DIRECTCONNECT 25 #define NDPI_PROTOCOL_SOCRATES 26 #define NDPI_PROTOCOL_COAP 27 #define NDPI_PROTOCOL_VMWARE 28 #define NDPI_PROTOCOL_MAIL_SMTPS 29 #define NDPI_PROTOCOL_FILETOPIA 30 #define NDPI_PROTOCOL_UBNTAC2 31 /* Ubiquity UBNT AirControl 2 - Thomas Fjellstrom */ #define NDPI_PROTOCOL_KONTIKI 32 #define NDPI_PROTOCOL_OPENFT 33 #define NDPI_PROTOCOL_FASTTRACK 34 #define NDPI_PROTOCOL_GNUTELLA 35 #define NDPI_PROTOCOL_EDONKEY 36 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_BITTORRENT 37 #define NDPI_PROTOCOL_EPP 38 #define NDPI_CONTENT_AVI 39 #define NDPI_CONTENT_FLASH 40 #define NDPI_CONTENT_OGG 41 #define NDPI_CONTENT_MPEG 42 #define NDPI_CONTENT_QUICKTIME 43 #define NDPI_CONTENT_REALMEDIA 44 #define NDPI_CONTENT_WINDOWSMEDIA 45 #define NDPI_CONTENT_MMS 46 #define NDPI_PROTOCOL_XBOX 47 #define NDPI_PROTOCOL_QQ 48 #define NDPI_PROTOCOL_MOVE 49 #define NDPI_PROTOCOL_RTSP 50 #define NDPI_PROTOCOL_MAIL_IMAPS 51 #define NDPI_PROTOCOL_ICECAST 52 #define NDPI_PROTOCOL_PPLIVE 53 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_PPSTREAM 54 #define NDPI_PROTOCOL_ZATTOO 55 #define NDPI_PROTOCOL_SHOUTCAST 56 #define NDPI_PROTOCOL_SOPCAST 57 #define NDPI_PROTOCOL_TVANTS 58 #define NDPI_PROTOCOL_TVUPLAYER 59 #define NDPI_PROTOCOL_HTTP_DOWNLOAD 60 #define NDPI_PROTOCOL_QQLIVE 61 #define NDPI_PROTOCOL_THUNDER 62 #define NDPI_PROTOCOL_SOULSEEK 63 #define NDPI_PROTOCOL_SSL_NO_CERT 64 #define NDPI_PROTOCOL_IRC 65 #define NDPI_PROTOCOL_AYIYA 66 #define NDPI_PROTOCOL_UNENCRYPTED_JABBER 67 #define NDPI_PROTOCOL_MSN 68 #define NDPI_PROTOCOL_OSCAR 69 #define NDPI_PROTOCOL_YAHOO 70 #define NDPI_PROTOCOL_BATTLEFIELD 71 #define NDPI_PROTOCOL_QUAKE 72 #define NDPI_PROTOCOL_IP_VRRP 73 #define NDPI_PROTOCOL_STEAM 74 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_HALFLIFE2 75 #define NDPI_PROTOCOL_WORLDOFWARCRAFT 76 #define NDPI_PROTOCOL_TELNET 77 #define NDPI_PROTOCOL_STUN 78 #define NDPI_PROTOCOL_IP_IPSEC 79 #define NDPI_PROTOCOL_IP_GRE 80 #define NDPI_PROTOCOL_IP_ICMP 81 #define NDPI_PROTOCOL_IP_IGMP 82 #define NDPI_PROTOCOL_IP_EGP 83 #define NDPI_PROTOCOL_IP_SCTP 84 #define NDPI_PROTOCOL_IP_OSPF 85 #define NDPI_PROTOCOL_IP_IP_IN_IP 86 #define NDPI_PROTOCOL_RTP 87 #define NDPI_PROTOCOL_RDP 88 #define NDPI_PROTOCOL_VNC 89 #define NDPI_PROTOCOL_PCANYWHERE 90 #define NDPI_PROTOCOL_SSL 91 #define NDPI_PROTOCOL_SSH 92 #define NDPI_PROTOCOL_USENET 93 #define NDPI_PROTOCOL_MGCP 94 #define NDPI_PROTOCOL_IAX 95 #define NDPI_PROTOCOL_TFTP 96 #define NDPI_PROTOCOL_AFP 97 #define NDPI_PROTOCOL_STEALTHNET 98 #define NDPI_PROTOCOL_AIMINI 99 #define NDPI_PROTOCOL_SIP 100 #define NDPI_PROTOCOL_TRUPHONE 101 #define NDPI_PROTOCOL_IP_ICMPV6 102 #define NDPI_PROTOCOL_DHCPV6 103 #define NDPI_PROTOCOL_ARMAGETRON 104 #define NDPI_PROTOCOL_CROSSFIRE 105 #define NDPI_PROTOCOL_DOFUS 106 #define NDPI_PROTOCOL_FIESTA 107 #define NDPI_PROTOCOL_FLORENSIA 108 #define NDPI_PROTOCOL_GUILDWARS 109 #define NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC 110 /*avoid large declarations in the future*/ #define NDPI_PROTOCOL_KERBEROS 111 #define NDPI_PROTOCOL_LDAP 112 #define NDPI_PROTOCOL_MAPLESTORY 113 #define NDPI_PROTOCOL_MSSQL_TDS 114 #define NDPI_PROTOCOL_PPTP 115 #define NDPI_PROTOCOL_WARCRAFT3 116 #define NDPI_PROTOCOL_WORLD_OF_KUNG_FU 117 #define NDPI_PROTOCOL_SLACK 118 #define NDPI_PROTOCOL_FACEBOOK 119 #define NDPI_PROTOCOL_TWITTER 120 #define NDPI_PROTOCOL_DROPBOX 121 #define NDPI_PROTOCOL_GMAIL 122 #define NDPI_PROTOCOL_GOOGLE_MAPS 123 #define NDPI_PROTOCOL_YOUTUBE 124 #define NDPI_PROTOCOL_SKYPE 125 #define NDPI_PROTOCOL_GOOGLE 126 #define NDPI_PROTOCOL_DCERPC 127 #define NDPI_PROTOCOL_NETFLOW 128 #define NDPI_PROTOCOL_SFLOW 129 #define NDPI_PROTOCOL_HTTP_CONNECT 130 #define NDPI_PROTOCOL_HTTP_PROXY 131 #define NDPI_PROTOCOL_CITRIX 132 #define NDPI_PROTOCOL_NETFLIX 133 #define NDPI_PROTOCOL_LASTFM 134 #define NDPI_PROTOCOL_WAZE 135 #define NDPI_PROTOCOL_YOUTUBE_UPLOAD 136 /* Upload files to youtube */ #define NDPI_PROTOCOL_ICQ 137 #define NDPI_PROTOCOL_CHECKMK 138 #define NDPI_PROTOCOL_CITRIX_ONLINE 139 #define NDPI_PROTOCOL_APPLE 140 #define NDPI_PROTOCOL_WEBEX 141 #define NDPI_PROTOCOL_WHATSAPP 142 #define NDPI_PROTOCOL_APPLE_ICLOUD 143 #define NDPI_PROTOCOL_VIBER 144 #define NDPI_PROTOCOL_APPLE_ITUNES 145 #define NDPI_PROTOCOL_RADIUS 146 #define NDPI_PROTOCOL_WINDOWS_UPDATE 147 #define NDPI_PROTOCOL_TEAMVIEWER 148 /* xplico.org */ #define NDPI_PROTOCOL_TUENTI 149 #define NDPI_PROTOCOL_LOTUS_NOTES 150 #define NDPI_PROTOCOL_SAP 151 #define NDPI_PROTOCOL_GTP 152 #define NDPI_PROTOCOL_UPNP 153 #define NDPI_PROTOCOL_LLMNR 154 #define NDPI_PROTOCOL_REMOTE_SCAN 155 #define NDPI_PROTOCOL_SPOTIFY 156 #define NDPI_CONTENT_WEBM 157 #define NDPI_PROTOCOL_H323 158 /* Remy Mudingay */ #define NDPI_PROTOCOL_OPENVPN 159 /* Remy Mudingay */ #define NDPI_PROTOCOL_NOE 160 /* Remy Mudingay */ #define NDPI_PROTOCOL_CISCOVPN 161 /* Remy Mudingay */ #define NDPI_PROTOCOL_TEAMSPEAK 162 /* Remy Mudingay */ #define NDPI_PROTOCOL_TOR 163 /* Remy Mudingay */ #define NDPI_PROTOCOL_SKINNY 164 /* Remy Mudingay */ #define NDPI_PROTOCOL_RTCP 165 /* Remy Mudingay */ #define NDPI_PROTOCOL_RSYNC 166 /* Remy Mudingay */ #define NDPI_PROTOCOL_ORACLE 167 /* Remy Mudingay */ #define NDPI_PROTOCOL_CORBA 168 /* Remy Mudingay */ #define NDPI_PROTOCOL_UBUNTUONE 169 /* Remy Mudingay */ #define NDPI_PROTOCOL_WHOIS_DAS 170 #define NDPI_PROTOCOL_COLLECTD 171 #define NDPI_PROTOCOL_SOCKS 172 /* Tomasz Bujlow */ /* The Lync protocol is now skype for business and this the old id 173 can now be recycled */ #define NDPI_PROTOCOL_NINTENDO 173 #define NDPI_PROTOCOL_RTMP 174 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_FTP_DATA 175 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_WIKIPEDIA 176 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_ZMQ 177 #define NDPI_PROTOCOL_AMAZON 178 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_EBAY 179 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_CNN 180 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_MEGACO 181 /* Gianluca Costa */ #define NDPI_PROTOCOL_REDIS 182 #define NDPI_PROTOCOL_PANDO 183 /* Tomasz Bujlow */ #define NDPI_PROTOCOL_VHUA 184 #define NDPI_PROTOCOL_TELEGRAM 185 /* Gianluca Costa */ #define NDPI_PROTOCOL_VEVO 186 #define NDPI_PROTOCOL_PANDORA 187 #define NDPI_PROTOCOL_QUIC 188 /* Andrea Buscarinu - Michele Campus */ #define NDPI_PROTOCOL_WHATSAPP_VOICE 189 #define NDPI_PROTOCOL_EAQ 190 #define NDPI_PROTOCOL_OOKLA 191 #define NDPI_PROTOCOL_AMQP 192 #define NDPI_PROTOCOL_KAKAOTALK 193 /* KakaoTalk Chat (no voice call) */ #define NDPI_PROTOCOL_KAKAOTALK_VOICE 194 /* KakaoTalk Voice */ #define NDPI_PROTOCOL_TWITCH 195 /* Edoardo Dominici */ #define NDPI_PROTOCOL_QUICKPLAY 196 /* Streaming service used by various services such as hooq.tv */ #define NDPI_PROTOCOL_WECHAT 197 #define NDPI_PROTOCOL_MPEGTS 198 #define NDPI_PROTOCOL_SNAPCHAT 199 #define NDPI_PROTOCOL_SINA 200 #define NDPI_PROTOCOL_HANGOUT 201 #define NDPI_PROTOCOL_IFLIX 202 /* www.vizuamatix.com R&D team & M.Mallawaarachchie */ #define NDPI_PROTOCOL_GITHUB 203 #define NDPI_PROTOCOL_BJNP 204 #define NDPI_PROTOCOL_1KXUN 205 #define NDPI_PROTOCOL_IQIYI 206 #define NDPI_PROTOCOL_SMPP 207 /* Damir Franusic */ #define NDPI_PROTOCOL_DNSCRYPT 208 #define NDPI_PROTOCOL_TINC 209 /* William Guglielmo */ #define NDPI_PROTOCOL_DEEZER 210 #define NDPI_PROTOCOL_INSTAGRAM 211 /* Andrea Buscarinu */ #define NDPI_PROTOCOL_MICROSOFT 212 #define NDPI_PROTOCOL_STARCRAFT 213 /* Matteo Bracci */ #define NDPI_PROTOCOL_TEREDO 214 #define NDPI_PROTOCOL_HOTSPOT_SHIELD 215 #define NDPI_PROTOCOL_HEP 216 /* sipcapture.org QXIP BV */ #define NDPI_PROTOCOL_GOOGLE_DRIVE 217 #define NDPI_PROTOCOL_OCS 218 #define NDPI_PROTOCOL_OFFICE_365 219 #define NDPI_PROTOCOL_CLOUDFLARE 220 #define NDPI_PROTOCOL_MS_ONE_DRIVE 221 #define NDPI_PROTOCOL_MQTT 222 #define NDPI_PROTOCOL_RX 223 #define NDPI_PROTOCOL_APPLESTORE 224 #define NDPI_PROTOCOL_OPENDNS 225 #define NDPI_PROTOCOL_GIT 226 #define NDPI_PROTOCOL_DRDA 227 #define NDPI_PROTOCOL_PLAYSTORE 228 #define NDPI_PROTOCOL_SOMEIP 229 #define NDPI_PROTOCOL_FIX 230 #define NDPI_PROTOCOL_PLAYSTATION 231 #define NDPI_PROTOCOL_PASTEBIN 232 /* Paulo Angelo */ #define NDPI_PROTOCOL_LINKEDIN 233 /* Paulo Angelo */ #define NDPI_PROTOCOL_SOUNDCLOUD 234 #define NDPI_PROTOCOL_CSGO 235 /* Counter-Strike Global Offensive, Dota 2 */ #define NDPI_PROTOCOL_LISP 236 /* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */ #define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_LISP #define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1) #define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL) #endif nDPI-2.2/src/include/ndpi_protocols.h000066400000000000000000001120271321103654100175670ustar00rootroot00000000000000/* * ndpi_protocols.h * * Copyright (C) 2011-16 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_PROTOCOLS_H__ #define __NDPI_PROTOCOLS_H__ #include "ndpi_main.h" ndpi_port_range* ndpi_build_default_ports_range(ndpi_port_range *ports, u_int16_t portA_low, u_int16_t portA_high, u_int16_t portB_low, u_int16_t portB_high, u_int16_t portC_low, u_int16_t portC_high, u_int16_t portD_low, u_int16_t portD_high, u_int16_t portE_low, u_int16_t portE_high); ndpi_port_range* ndpi_build_default_ports(ndpi_port_range *ports, u_int16_t portA, u_int16_t portB, u_int16_t portC, u_int16_t portD, u_int16_t portE); /* TCP/UDP protocols */ u_int ndpi_search_tcp_or_udp_raw(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t protocol, u_int32_t saddr, u_int32_t daddr, u_int16_t sport, u_int16_t dport); void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); /* Applications and other protocols. */ void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_lisp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_edonkey(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_fasttrack_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_gnutella(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_directconnect(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_applejuice_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_i23v5(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_socrates(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_soulseek_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_msn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_yahoo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_oscar(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_sip(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_hep(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_direct_download_link_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mail_pop_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mail_imap_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_http_subprotocol_conf(struct ndpi_detection_module_struct *ndpi_struct, char *attr, char *value, int protocol_id); void ndpi_search_ftp_control(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ftp_data(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_usenet_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_rtsp_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_filetopia_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_vmware(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ssl_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mms_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_icecast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_shoutcast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_veohtv_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_openft_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_tvants_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_sopcast(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_tvuplayer(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ppstream(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_pplive(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_iax(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mgcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_zattoo(struct ndpi_detection_module_struct*ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_qq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_feidian(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ayiya(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_thunder(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_activesync(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_in_non_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_vnc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_dhcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_steam(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_halflife2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_smb_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_telnet_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ntp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_nfs(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ssdp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_worldofwarcraft(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_postgres_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mysql_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_bgp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_quake(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_battlefield(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_secondlife(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_pcanywhere(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_snmp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_kontiki(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_syslog(struct ndpi_detection_module_struct*ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_netbios(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ipp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ldap(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_warcraft3(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_xdmcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_tftp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mssql_tds(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_pptp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_stealthnet(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_dhcpv6_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_afp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_checkmk(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_aimini(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_florensia(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_maplestory(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_dofus(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_world_of_kung_fu(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_fiesta(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_crossfire_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_guildwars_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_armagetron_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_dropbox(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_citrix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_dcerpc(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_netflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_sflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_radius(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_wsus(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_teamview(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_lotus_notes(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_gtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_spotify(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_h323(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_openvpn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_noe(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_viber(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_teamspeak(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_corba(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_collectd(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_rsync(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_rtcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_skinny(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_tor(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_whois_das(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_socks5(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_socks4(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_rtmp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_pando(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_megaco(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_redis(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_zmq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_vhua(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_telegram(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_eaq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_kakaotalk_voice(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mpegts(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_starcraft(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_ubntac2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_coap(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_mqtt (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_rx(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_drda(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_bjnp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_smpp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_tinc(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_fix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); void ndpi_search_csgo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); /* --- INIT FUNCTIONS --- */ void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_armagetron_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_amqp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_battlefield_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_bgp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_lisp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_teredo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ciscovpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_citrix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_corba_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_crossfire_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_dcerpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_dhcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_dhcpv6_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_directconnect_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_dns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_dofus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_directdownloadlink_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_dropbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_eaq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_edonkey_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_fasttrack_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_fiesta_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_filetopia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_florensia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ftp_control_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ftp_data_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_gnutella_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_gtp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_guildwars_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_h323_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_halflife2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_http_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_http_activesync_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_iax_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_icecast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ipp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_irc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_jabber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_kakaotalk_voice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_kerberos_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_kontiki_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ldap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_lotus_notes_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mail_imap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mail_pop_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mail_smtp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_maplestory_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mdns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_megaco_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mgpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mms_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_msn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mpegts_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mssql_tds_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mysql_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_netbios_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_netflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_nfs_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_noe_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_non_tcp_udp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ntp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_openft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_openvpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_oracle_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_oscar_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_pando_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_pcanywhere_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_postgres_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_pplive_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ppstream_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_pptp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_qq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_quake_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_radius_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_rdp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_redis_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_rsync_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_rtcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_rtmp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_rtp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_rtsp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_sflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_shoutcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_sip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_hep_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_skinny_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_skype_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_smb_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_snmp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_socrates_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_sopcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_soulseek_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_socks_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_spotify_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ssh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ssl_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_syslog_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ssdp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_teamspeak_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_teamviewer_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_telegram_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_telnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_tftp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_thunder_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_tor_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_tvants_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_tvuplayer_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_usenet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_veohtv_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_vhua_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_viber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_vmware_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_vnc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_warcraft3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_whois_das_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_world_of_warcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_world_of_kung_fu_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_xbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_xdmcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_yahoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_zattoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_zmq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_stracraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_ubntac2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_coap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_mqtt_dissector (struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_someip_dissector (struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_rx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_hangout_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_drda_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_bjnp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_smpp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_tinc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_fix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_nintendo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_csgo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); void init_checkmk_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask); #endif /* __NDPI_PROTOCOLS_H__ */ nDPI-2.2/src/include/ndpi_typedefs.h000066400000000000000000000747371321103654100174050ustar00rootroot00000000000000/* * ndpi_typedefs.h * * Copyright (C) 2011-16 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_TYPEDEFS_H__ #define __NDPI_TYPEDEFS_H__ #include "ndpi_define.h" #include "../lib/third_party/include/libcache.h" #define BT_ANNOUNCE #define SNAP_EXT /* NDPI_LOG_LEVEL */ typedef enum { NDPI_LOG_ERROR, NDPI_LOG_TRACE, NDPI_LOG_DEBUG } ndpi_log_level_t; /* NDPI_VISIT */ typedef enum { ndpi_preorder, ndpi_postorder, ndpi_endorder, ndpi_leaf } ndpi_VISIT; /* NDPI_NODE */ typedef struct node_t { char *key; struct node_t *left, *right; } ndpi_node; /* NDPI_MASK_SIZE */ typedef u_int32_t ndpi_ndpi_mask; /* NDPI_PROTO_BITMASK_STRUCT */ typedef struct ndpi_protocol_bitmask_struct { ndpi_ndpi_mask fds_bits[NDPI_NUM_FDS_BITS]; } ndpi_protocol_bitmask_struct_t; /* NDPI_DEBUG_FUNCTION_PTR (cast) */ typedef void (*ndpi_debug_function_ptr) (u_int32_t protocol, void *module_struct, ndpi_log_level_t log_level, const char *format, ...); /* ************************************************************ */ /* ******************* NDPI NETWORKS HEADERS ****************** */ /* ************************************************************ */ /* ++++++++++++++++++++++++ Cisco headers +++++++++++++++++++++ */ /* Cisco HDLC */ #ifdef _MSC_VER /* Windows */ #define PACK_ON __pragma(pack(push, 1)) #define PACK_OFF __pragma(pack(pop)) #elif defined(__GNUC__) /* GNU C */ #define PACK_ON #define PACK_OFF __attribute__((packed)) #endif PACK_ON struct ndpi_chdlc { u_int8_t addr; /* 0x0F (Unicast) - 0x8F (Broadcast) */ u_int8_t ctrl; /* always 0x00 */ u_int16_t proto_code; /* protocol type (e.g. 0x0800 IP) */ } PACK_OFF; /* SLARP - Serial Line ARP http://tinyurl.com/qa54e95 */ PACK_ON struct ndpi_slarp { /* address requests (0x00) address replies (0x01) keep-alive (0x02) */ u_int32_t slarp_type; u_int32_t addr_1; u_int32_t addr_2; } PACK_OFF; /* Cisco Discovery Protocol http://tinyurl.com/qa6yw9l */ PACK_ON struct ndpi_cdp { u_int8_t version; u_int8_t ttl; u_int16_t checksum; u_int16_t type; u_int16_t length; } PACK_OFF; /* +++++++++++++++ Ethernet header (IEEE 802.3) +++++++++++++++ */ PACK_ON struct ndpi_ethhdr { u_char h_dest[6]; /* destination eth addr */ u_char h_source[6]; /* source ether addr */ u_int16_t h_proto; /* data length (<= 1500) or type ID proto (>=1536) */ } PACK_OFF; /* +++++++++++++++++++ LLC header (IEEE 802.2) ++++++++++++++++ */ PACK_ON struct ndpi_snap_extension { u_int16_t oui; u_int8_t oui2; u_int16_t proto_ID; } PACK_OFF; PACK_ON struct ndpi_llc_header_snap { u_int8_t dsap; u_int8_t ssap; u_int8_t ctrl; struct ndpi_snap_extension snap; } PACK_OFF; /* ++++++++++ RADIO TAP header (for IEEE 802.11) +++++++++++++ */ PACK_ON struct ndpi_radiotap_header { u_int8_t version; /* set to 0 */ u_int8_t pad; u_int16_t len; u_int32_t present; u_int64_t MAC_timestamp; u_int8_t flags; } PACK_OFF; /* ++++++++++++ Wireless header (IEEE 802.11) ++++++++++++++++ */ PACK_ON struct ndpi_wifi_header { u_int16_t fc; u_int16_t duration; u_char rcvr[6]; u_char trsm[6]; u_char dest[6]; u_int16_t seq_ctrl; /* u_int64_t ccmp - for data encryption only - check fc.flag */ } PACK_OFF; /* +++++++++++++++++++++++ MPLS header +++++++++++++++++++++++ */ PACK_ON struct ndpi_mpls_header { u_int32_t label:20, exp:3, s:1, ttl:8; } PACK_OFF; /* ++++++++++++++++++++++++ IP header ++++++++++++++++++++++++ */ PACK_ON struct ndpi_iphdr { #if defined(__LITTLE_ENDIAN__) u_int8_t ihl:4, version:4; #elif defined(__BIG_ENDIAN__) u_int8_t version:4, ihl:4; #else # error "Byte order must be defined" #endif u_int8_t tos; u_int16_t tot_len; u_int16_t id; u_int16_t frag_off; u_int8_t ttl; u_int8_t protocol; u_int16_t check; u_int32_t saddr; u_int32_t daddr; } PACK_OFF; /* +++++++++++++++++++++++ IPv6 header +++++++++++++++++++++++ */ /* rfc3542 */ struct ndpi_in6_addr { union { u_int8_t u6_addr8[16]; u_int16_t u6_addr16[8]; u_int32_t u6_addr32[4]; } u6_addr; /* 128-bit IP6 address */ }; PACK_ON struct ndpi_ipv6hdr { union { struct ndpi_ip6_hdrctl { u_int32_t ip6_un1_flow; u_int16_t ip6_un1_plen; u_int8_t ip6_un1_nxt; u_int8_t ip6_un1_hlim; } ip6_un1; u_int8_t ip6_un2_vfc; } ip6_ctlun; struct ndpi_in6_addr ip6_src; struct ndpi_in6_addr ip6_dst; } PACK_OFF; /* +++++++++++++++++++++++ TCP header +++++++++++++++++++++++ */ PACK_ON struct ndpi_tcphdr { u_int16_t source; u_int16_t dest; u_int32_t seq; u_int32_t ack_seq; #if defined(__LITTLE_ENDIAN__) u_int16_t res1:4, doff:4, fin:1, syn:1, rst:1, psh:1, ack:1, urg:1, ece:1, cwr:1; #elif defined(__BIG_ENDIAN__) u_int16_t doff:4, res1:4, cwr:1, ece:1, urg:1, ack:1, psh:1, rst:1, syn:1, fin:1; #else # error "Byte order must be defined" #endif u_int16_t window; u_int16_t check; u_int16_t urg_ptr; } PACK_OFF; /* +++++++++++++++++++++++ UDP header +++++++++++++++++++++++ */ PACK_ON struct ndpi_udphdr { u_int16_t source; u_int16_t dest; u_int16_t len; u_int16_t check; } PACK_OFF; PACK_ON struct ndpi_dns_packet_header { u_int16_t tr_id; u_int16_t flags; u_int16_t num_queries; u_int16_t num_answers; u_int16_t authority_rrs; u_int16_t additional_rrs; } PACK_OFF; typedef union { u_int32_t ipv4; u_int8_t ipv4_u_int8_t[4]; #ifdef NDPI_DETECTION_SUPPORT_IPV6 struct ndpi_in6_addr ipv6; #endif } ndpi_ip_addr_t; /* +++++++++++++++++++++++ ICMP header +++++++++++++++++++++++ */ PACK_ON struct ndpi_icmphdr { u_int8_t type;/* message type */ u_int8_t code;/* type sub-code */ u_int16_t checksum; union { struct { u_int16_t id; u_int16_t sequence; } echo; /* echo datagram */ u_int32_t gateway; /* gateway address */ struct { u_int16_t _unused; u_int16_t mtu; } frag;/* path mtu discovery */ } un; } PACK_OFF; /* ************************************************************ */ /* ******************* ********************* ****************** */ /* ************************************************************ */ #ifdef NDPI_PROTOCOL_BITTORRENT typedef struct spinlock { volatile int val; } spinlock_t; typedef struct atomic { volatile int counter; } atomic_t; struct hash_ip4p_node { struct hash_ip4p_node *next,*prev; time_t lchg; u_int16_t port,count:12,flag:4; u_int32_t ip; // + 12 bytes for ipv6 }; struct hash_ip4p { struct hash_ip4p_node *top; spinlock_t lock; size_t len; }; struct hash_ip4p_table { size_t size; int ipv6; spinlock_t lock; atomic_t count; struct hash_ip4p tbl; }; struct bt_announce { // 192 bytes u_int32_t hash[5]; u_int32_t ip[4]; u_int32_t time; u_int16_t port; u_int8_t name_len, name[192 - 4*10 - 2 - 1]; // 149 bytes }; #endif #ifdef NDPI_PROTOCOL_TINC #define TINC_CACHE_MAX_SIZE 10 PACK_ON struct tinc_cache_entry { u_int32_t src_address; u_int32_t dst_address; u_int16_t dst_port; } PACK_OFF; #endif typedef enum { HTTP_METHOD_UNKNOWN = 0, HTTP_METHOD_OPTIONS, HTTP_METHOD_GET, HTTP_METHOD_HEAD, HTTP_METHOD_POST, HTTP_METHOD_PUT, HTTP_METHOD_DELETE, HTTP_METHOD_TRACE, HTTP_METHOD_CONNECT } ndpi_http_method; struct ndpi_id_struct { /** detected_protocol_bitmask: access this bitmask to find out whether an id has used skype or not if a flag is set here, it will not be reset to compare this, use: **/ NDPI_PROTOCOL_BITMASK detected_protocol_bitmask; #ifdef NDPI_PROTOCOL_RTSP ndpi_ip_addr_t rtsp_ip_address; #endif #ifdef NDPI_PROTOCOL_SIP #ifdef NDPI_PROTOCOL_YAHOO u_int32_t yahoo_video_lan_timer; #endif #endif /* NDPI_PROTOCOL_IRC_MAXPORT % 2 must be 0 */ #ifdef NDPI_PROTOCOL_IRC #define NDPI_PROTOCOL_IRC_MAXPORT 8 u_int16_t irc_port[NDPI_PROTOCOL_IRC_MAXPORT]; u_int32_t last_time_port_used[NDPI_PROTOCOL_IRC_MAXPORT]; u_int32_t irc_ts; #endif #ifdef NDPI_PROTOCOL_GNUTELLA u_int32_t gnutella_ts; #endif #ifdef NDPI_PROTOCOL_BATTLEFIELD u_int32_t battlefield_ts; #endif #ifdef NDPI_PROTOCOL_THUNDER u_int32_t thunder_ts; #endif #ifdef NDPI_PROTOCOL_RTSP u_int32_t rtsp_timer; #endif #ifdef NDPI_PROTOCOL_OSCAR u_int32_t oscar_last_safe_access_time; #endif #ifdef NDPI_PROTOCOL_ZATTOO u_int32_t zattoo_ts; #endif #ifdef NDPI_PROTOCOL_UNENCRYPTED_JABBER u_int32_t jabber_stun_or_ft_ts; #endif #ifdef NDPI_PROTOCOL_DIRECTCONNECT u_int32_t directconnect_last_safe_access_time; #endif #ifdef NDPI_PROTOCOL_SOULSEEK u_int32_t soulseek_last_safe_access_time; #endif #ifdef NDPI_PROTOCOL_DIRECTCONNECT u_int16_t detected_directconnect_port; u_int16_t detected_directconnect_udp_port; u_int16_t detected_directconnect_ssl_port; #endif #ifdef NDPI_PROTOCOL_BITTORRENT #define NDPI_BT_PORTS 8 u_int16_t bt_port_t[NDPI_BT_PORTS]; u_int16_t bt_port_u[NDPI_BT_PORTS]; #endif #ifdef NDPI_PROTOCOL_UNENCRYPTED_JABBER #define JABBER_MAX_STUN_PORTS 6 u_int16_t jabber_voice_stun_port[JABBER_MAX_STUN_PORTS]; u_int16_t jabber_file_transfer_port[2]; #endif #ifdef NDPI_PROTOCOL_GNUTELLA u_int16_t detected_gnutella_port; #endif #ifdef NDPI_PROTOCOL_GNUTELLA u_int16_t detected_gnutella_udp_port1; u_int16_t detected_gnutella_udp_port2; #endif #ifdef NDPI_PROTOCOL_SOULSEEK u_int16_t soulseek_listen_port; #endif #ifdef NDPI_PROTOCOL_IRC u_int8_t irc_number_of_port; #endif #ifdef NDPI_PROTOCOL_OSCAR u_int8_t oscar_ssl_session_id[33]; #endif #ifdef NDPI_PROTOCOL_UNENCRYPTED_JABBER u_int8_t jabber_voice_stun_used_ports; #endif #ifdef NDPI_PROTOCOL_SIP #ifdef NDPI_PROTOCOL_YAHOO u_int32_t yahoo_video_lan_dir:1; #endif #endif #ifdef NDPI_PROTOCOL_YAHOO u_int32_t yahoo_conf_logged_in:1; u_int32_t yahoo_voice_conf_logged_in:1; #endif #ifdef NDPI_PROTOCOL_RTSP u_int32_t rtsp_ts_set:1; #endif }; /* ************************************************** */ struct ndpi_flow_tcp_struct { #ifdef NDPI_PROTOCOL_MAIL_SMTP u_int16_t smtp_command_bitmask; #endif #ifdef NDPI_PROTOCOL_MAIL_POP u_int16_t pop_command_bitmask; #endif #ifdef NDPI_PROTOCOL_QQ u_int16_t qq_nxt_len; #endif #ifdef NDPI_PROTOCOL_TDS u_int8_t tds_login_version; #endif #ifdef NDPI_PROTOCOL_IRC u_int8_t irc_stage; u_int8_t irc_port; #endif #ifdef NDPI_PROTOCOL_H323 u_int8_t h323_valid_packets; #endif #ifdef NDPI_PROTOCOL_GNUTELLA u_int8_t gnutella_msg_id[3]; #endif #ifdef NDPI_PROTOCOL_IRC u_int32_t irc_3a_counter:3; u_int32_t irc_stage2:5; u_int32_t irc_direction:2; u_int32_t irc_0x1000_full:1; #endif #ifdef NDPI_PROTOCOL_SOULSEEK u_int32_t soulseek_stage:2; #endif #ifdef NDPI_PROTOCOL_FILETOPIA u_int32_t filetopia_stage:2; #endif #ifdef NDPI_PROTOCOL_TDS u_int32_t tds_stage:3; #endif #ifdef NDPI_PROTOCOL_USENET u_int32_t usenet_stage:2; #endif #ifdef NDPI_PROTOCOL_IMESH u_int32_t imesh_stage:4; #endif #ifdef NDPI_PROTOCOL_HTTP u_int32_t http_setup_dir:2; u_int32_t http_stage:2; u_int32_t http_empty_line_seen:1; u_int32_t http_wait_for_retransmission:1; #endif #ifdef NDPI_PROTOCOL_GNUTELLA u_int32_t gnutella_stage:2; // 0 - 2 #endif #ifdef NDPI_CONTENT_MMS u_int32_t mms_stage:2; #endif #ifdef NDPI_PROTOCOL_YAHOO u_int32_t yahoo_sip_comm:1; u_int32_t yahoo_http_proxy_stage:2; #endif #ifdef NDPI_PROTOCOL_MSN u_int32_t msn_stage:3; u_int32_t msn_ssl_ft:2; #endif #ifdef NDPI_PROTOCOL_SSH u_int32_t ssh_stage:3; #endif #ifdef NDPI_PROTOCOL_VNC u_int32_t vnc_stage:2; // 0 - 3 #endif #ifdef NDPI_PROTOCOL_TELNET u_int32_t telnet_stage:2; // 0 - 2 #endif #ifdef NDPI_PROTOCOL_SSL u_int8_t ssl_stage:2, ssl_seen_client_cert:1, ssl_seen_server_cert:1; // 0 - 5 #endif #ifdef NDPI_PROTOCOL_POSTGRES u_int32_t postgres_stage:3; #endif #ifdef NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK u_int32_t ddlink_server_direction:1; #endif u_int32_t seen_syn:1; u_int32_t seen_syn_ack:1; u_int32_t seen_ack:1; #ifdef NDPI_PROTOCOL_ICECAST u_int32_t icecast_stage:1; #endif #ifdef NDPI_PROTOCOL_DOFUS u_int32_t dofus_stage:1; #endif #ifdef NDPI_PROTOCOL_FIESTA u_int32_t fiesta_stage:2; #endif #ifdef NDPI_PROTOCOL_WORLDOFWARCRAFT u_int32_t wow_stage:2; #endif #ifdef NDPI_PROTOCOL_HTTP_APPLICATION_VEOHTV u_int32_t veoh_tv_stage:2; #endif #ifdef NDPI_PROTOCOL_SHOUTCAST u_int32_t shoutcast_stage:2; #endif #ifdef NDPI_PROTOCOL_RTP u_int32_t rtp_special_packets_seen:1; #endif #ifdef NDPI_PROTOCOL_MAIL_POP u_int32_t mail_pop_stage:2; #endif #ifdef NDPI_PROTOCOL_MAIL_IMAP u_int32_t mail_imap_stage:3, mail_imap_starttls:2; #endif #ifdef NDPI_PROTOCOL_SKYPE u_int8_t skype_packet_id; #endif #ifdef NDPI_PROTOCOL_CITRIX u_int8_t citrix_packet_id; #endif #ifdef NDPI_PROTOCOL_LOTUS_NOTES u_int8_t lotus_notes_packet_id; #endif #ifdef NDPI_PROTOCOL_TEAMVIEWER u_int8_t teamviewer_stage; #endif #ifdef NDPI_PROTOCOL_ZMQ u_int8_t prev_zmq_pkt_len; u_char prev_zmq_pkt[10]; #endif #ifdef NDPI_PROTOCOL_PPSTREAM u_int32_t ppstream_stage:3; #endif } #ifndef WIN32 __attribute__ ((__packed__)) #endif ; /* ************************************************** */ struct ndpi_flow_udp_struct { #ifdef NDPI_PROTOCOL_BATTLEFIELD u_int32_t battlefield_msg_id; #endif #ifdef NDPI_PROTOCOL_SNMP u_int32_t snmp_msg_id; #endif #ifdef NDPI_PROTOCOL_BATTLEFIELD u_int32_t battlefield_stage:3; #endif #ifdef NDPI_PROTOCOL_SNMP u_int32_t snmp_stage:2; #endif #ifdef NDPI_PROTOCOL_PPSTREAM u_int32_t ppstream_stage:3; // 0 - 7 #endif #ifdef NDPI_PROTOCOL_HALFLIFE2 u_int32_t halflife2_stage:2; // 0 - 2 #endif #ifdef NDPI_PROTOCOL_TFTP u_int32_t tftp_stage:1; #endif #ifdef NDPI_PROTOCOL_AIMINI u_int32_t aimini_stage:5; #endif #ifdef NDPI_PROTOCOL_XBOX u_int32_t xbox_stage:1; #endif #ifdef NDPI_PROTOCOL_WINDOWS_UPDATE u_int32_t wsus_stage:1; #endif #ifdef NDPI_PROTOCOL_SKYPE u_int8_t skype_packet_id; #endif #ifdef NDPI_PROTOCOL_TEAMVIEWER u_int8_t teamviewer_stage; #endif #ifdef NDPI_PROTOCOL_EAQ u_int8_t eaq_pkt_id; u_int32_t eaq_sequence; #endif #ifdef NDPI_PROTOCOL_RX u_int32_t rx_conn_epoch; u_int32_t rx_conn_id; #endif } #ifndef WIN32 __attribute__ ((__packed__)) #endif ; /* ************************************************** */ struct ndpi_int_one_line_struct { const u_int8_t *ptr; u_int16_t len; }; struct ndpi_packet_struct { const struct ndpi_iphdr *iph; #ifdef NDPI_DETECTION_SUPPORT_IPV6 const struct ndpi_ipv6hdr *iphv6; #endif const struct ndpi_tcphdr *tcp; const struct ndpi_udphdr *udp; const u_int8_t *generic_l4_ptr; /* is set only for non tcp-udp traffic */ const u_int8_t *payload; u_int32_t tick_timestamp; u_int64_t tick_timestamp_l; u_int16_t detected_protocol_stack[NDPI_PROTOCOL_SIZE]; u_int8_t detected_subprotocol_stack[NDPI_PROTOCOL_SIZE]; #ifndef WIN32 __attribute__ ((__packed__)) #endif u_int16_t protocol_stack_info; struct ndpi_int_one_line_struct line[NDPI_MAX_PARSE_LINES_PER_PACKET]; /* HTTP headers */ struct ndpi_int_one_line_struct host_line; struct ndpi_int_one_line_struct forwarded_line; struct ndpi_int_one_line_struct referer_line; struct ndpi_int_one_line_struct content_line; struct ndpi_int_one_line_struct accept_line; struct ndpi_int_one_line_struct user_agent_line; struct ndpi_int_one_line_struct http_url_name; struct ndpi_int_one_line_struct http_encoding; struct ndpi_int_one_line_struct http_transfer_encoding; struct ndpi_int_one_line_struct http_contentlen; struct ndpi_int_one_line_struct http_cookie; struct ndpi_int_one_line_struct http_origin; struct ndpi_int_one_line_struct http_x_session_type; struct ndpi_int_one_line_struct server_line; struct ndpi_int_one_line_struct http_method; struct ndpi_int_one_line_struct http_response; /* the first "word" in this pointer is the response code in the packet (200, etc) */ u_int8_t http_num_headers; /* number of found (valid) header lines in HTTP request or response */ u_int16_t l3_packet_len; u_int16_t l4_packet_len; u_int16_t payload_packet_len; u_int16_t actual_payload_len; u_int16_t num_retried_bytes; u_int16_t parsed_lines; u_int16_t parsed_unix_lines; u_int16_t empty_line_position; u_int8_t tcp_retransmission; u_int8_t l4_protocol; u_int8_t ssl_certificate_detected:4, ssl_certificate_num_checks:4; u_int8_t packet_lines_parsed_complete:1, packet_direction:1, empty_line_position_set:1; }; struct ndpi_detection_module_struct; struct ndpi_flow_struct; struct ndpi_call_function_struct { NDPI_PROTOCOL_BITMASK detection_bitmask; NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask; NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_bitmask; void (*func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow); u_int8_t detection_feature; }; struct ndpi_subprotocol_conf_struct { void (*func) (struct ndpi_detection_module_struct *, char *attr, char *value, int protocol_id); }; typedef struct { u_int16_t port_low, port_high; } ndpi_port_range; typedef enum { NDPI_PROTOCOL_SAFE = 0, /* Surely doesn’t provide risks for the network. (e.g., a news site) */ NDPI_PROTOCOL_ACCEPTABLE, /* Probably doesn’t provide risks, but could be malicious (e.g., Dropbox) */ NDPI_PROTOCOL_FUN, /* Pure fun protocol, which may be prohibited by the user policy (e.g., Netflix) */ NDPI_PROTOCOL_UNSAFE, /* Probably provides risks, but could be a normal traffic. Unencrypted protocols with clear pass should be here (e.g., telnet) */ NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, /* Surely is dangerous (ex. Tor). Be prepared to troubles */ NDPI_PROTOCOL_UNRATED /* No idea, not implemented or impossible to classify */ } ndpi_protocol_breed_t; #define NUM_BREEDS (NDPI_PROTOCOL_UNRATED+1) /* Abstract categories to group the protocols. */ typedef enum { NDPI_PROTOCOL_CATEGORY_UNSPECIFIED = 0, /* For general services and unknown protocols */ NDPI_PROTOCOL_CATEGORY_MEDIA, /* Multimedia and streaming */ NDPI_PROTOCOL_CATEGORY_VPN, /* Virtual Private Networks */ NDPI_PROTOCOL_CATEGORY_MAIL, /* Protocols to send/receive/sync emails */ NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, /* AFS/NFS and similar protocols */ NDPI_PROTOCOL_CATEGORY_WEB, /* Web protocols and services */ NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, /* Social networks */ NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, /* Download, FTP, file transfer/sharing */ NDPI_PROTOCOL_CATEGORY_GAME, /* Online games */ NDPI_PROTOCOL_CATEGORY_CHAT, /* Instant messaging */ NDPI_PROTOCOL_CATEGORY_VOIP, /* Real-time communications and conferencing */ NDPI_PROTOCOL_CATEGORY_DATABASE, /* Protocols for database communication */ NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, /* Remote access and control */ NDPI_PROTOCOL_CATEGORY_CLOUD, /* Online cloud services */ NDPI_PROTOCOL_CATEGORY_NETWORK, /* Network infrastructure protocols */ NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, /* Software for collaborative development, including Webmail */ NDPI_PROTOCOL_CATEGORY_RPC, /* High level network communication protocols */ NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, /* Network administration and monitor protocols */ NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, /* System/Operating System level applications */ NDPI_PROTOCOL_CATEGORY_SW_UPDATE, /* Software update */ /* See #define NUM_CUSTOM_CATEGORIES */ NDPI_PROTOCOL_CATEGORY_CUSTOM_1, /* User custom category 1 */ NDPI_PROTOCOL_CATEGORY_CUSTOM_2, /* User custom category 2 */ NDPI_PROTOCOL_CATEGORY_CUSTOM_3, /* User custom category 3 */ NDPI_PROTOCOL_CATEGORY_CUSTOM_4, /* User custom category 4 */ NDPI_PROTOCOL_CATEGORY_CUSTOM_5, /* User custom category 5 */ NDPI_PROTOCOL_NUM_CATEGORIES /* NOTE: Keep this as last member Unused as value but useful to getting the number of elements in this datastructure */ } ndpi_protocol_category_t; /* ntop extensions */ typedef struct ndpi_proto_defaults { char *protoName; ndpi_protocol_category_t protoCategory; u_int16_t protoId, protoIdx; u_int16_t master_tcp_protoId[2], master_udp_protoId[2]; /* The main protocols on which this sub-protocol sits on */ ndpi_protocol_breed_t protoBreed; void (*func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow); } ndpi_proto_defaults_t; typedef struct ndpi_default_ports_tree_node { ndpi_proto_defaults_t *proto; u_int8_t customUserProto; u_int16_t default_port; } ndpi_default_ports_tree_node_t; typedef struct _ndpi_automa { void *ac_automa; /* Real type is AC_AUTOMATA_t */ u_int8_t ac_automa_finalized; } ndpi_automa; typedef struct ndpi_proto { u_int16_t master_protocol /* e.g. HTTP */, app_protocol /* e.g. FaceBook */; } ndpi_protocol; #define NDPI_PROTOCOL_NULL { NDPI_PROTOCOL_UNKNOWN , NDPI_PROTOCOL_UNKNOWN } #define NUM_CUSTOM_CATEGORIES 5 #define CUSTOM_CATEGORY_LABEL_LEN 32 struct ndpi_detection_module_struct { NDPI_PROTOCOL_BITMASK detection_bitmask; NDPI_PROTOCOL_BITMASK generic_http_packet_bitmask; u_int32_t current_ts; u_int32_t ticks_per_second; #ifdef NDPI_ENABLE_DEBUG_MESSAGES void *user_data; #endif char custom_category_labels[NUM_CUSTOM_CATEGORIES][CUSTOM_CATEGORY_LABEL_LEN]; /* callback function buffer */ struct ndpi_call_function_struct callback_buffer[NDPI_MAX_SUPPORTED_PROTOCOLS + 1]; u_int32_t callback_buffer_size; struct ndpi_call_function_struct callback_buffer_tcp_no_payload[NDPI_MAX_SUPPORTED_PROTOCOLS + 1]; u_int32_t callback_buffer_size_tcp_no_payload; struct ndpi_call_function_struct callback_buffer_tcp_payload[NDPI_MAX_SUPPORTED_PROTOCOLS + 1]; u_int32_t callback_buffer_size_tcp_payload; struct ndpi_call_function_struct callback_buffer_udp[NDPI_MAX_SUPPORTED_PROTOCOLS + 1]; u_int32_t callback_buffer_size_udp; struct ndpi_call_function_struct callback_buffer_non_tcp_udp[NDPI_MAX_SUPPORTED_PROTOCOLS + 1]; u_int32_t callback_buffer_size_non_tcp_udp; ndpi_default_ports_tree_node_t *tcpRoot, *udpRoot; #ifdef NDPI_ENABLE_DEBUG_MESSAGES /* debug callback, only set when debug is used */ ndpi_debug_function_ptr ndpi_debug_printf; const char *ndpi_debug_print_file; const char *ndpi_debug_print_function; u_int32_t ndpi_debug_print_line; #endif /* misc parameters */ u_int32_t tcp_max_retransmission_window_size; u_int32_t directconnect_connection_ip_tick_timeout; /* subprotocol registration handler */ struct ndpi_subprotocol_conf_struct subprotocol_conf[NDPI_MAX_SUPPORTED_PROTOCOLS + 1]; u_int ndpi_num_supported_protocols; u_int ndpi_num_custom_protocols; /* HTTP/DNS/HTTPS host matching */ ndpi_automa host_automa, /* Used for DNS/HTTPS */ content_automa, /* Used for HTTP subprotocol_detection */ subprotocol_automa, /* Used for HTTP subprotocol_detection */ bigrams_automa, impossible_bigrams_automa; /* TOR */ /* IP-based protocol detection */ void *protocols_ptree; /* irc parameters */ u_int32_t irc_timeout; /* gnutella parameters */ u_int32_t gnutella_timeout; /* battlefield parameters */ u_int32_t battlefield_timeout; /* thunder parameters */ u_int32_t thunder_timeout; /* SoulSeek parameters */ u_int32_t soulseek_connection_ip_tick_timeout; /* rtsp parameters */ u_int32_t rtsp_connection_timeout; /* tvants parameters */ u_int32_t tvants_connection_timeout; /* rstp */ u_int32_t orb_rstp_ts_timeout; /* yahoo */ u_int8_t yahoo_detect_http_connections; u_int32_t yahoo_lan_video_timeout; u_int32_t zattoo_connection_timeout; u_int32_t jabber_stun_timeout; u_int32_t jabber_file_transfer_timeout; #ifdef NDPI_ENABLE_DEBUG_MESSAGES #define NDPI_IP_STRING_SIZE 40 char ip_string[NDPI_IP_STRING_SIZE]; #endif u_int8_t ip_version_limit; #ifdef NDPI_PROTOCOL_BITTORRENT struct hash_ip4p_table *bt_ht; #ifdef NDPI_DETECTION_SUPPORT_IPV6 struct hash_ip4p_table *bt6_ht; #endif #ifdef BT_ANNOUNCE struct bt_announce *bt_ann; int bt_ann_len; #endif #endif #ifdef NDPI_PROTOCOL_TINC cache_t tinc_cache; #endif ndpi_proto_defaults_t proto_defaults[NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS]; u_int8_t http_dont_dissect_response:1, dns_dissect_response:1, direction_detect_disable:1; /* disable internal detection of packet direction */ }; struct ndpi_flow_struct { u_int16_t detected_protocol_stack[NDPI_PROTOCOL_SIZE]; #ifndef WIN32 __attribute__ ((__packed__)) #endif u_int16_t protocol_stack_info; /* init parameter, internal used to set up timestamp,... */ u_int16_t guessed_protocol_id, guessed_host_protocol_id; u_int8_t protocol_id_already_guessed:1, host_already_guessed:1, init_finished:1, setup_packet_direction:1, packet_direction:1, check_extra_packets:1; /* if ndpi_struct->direction_detect_disable == 1 tcp sequence number connection tracking */ u_int32_t next_tcp_seq_nr[2]; u_int8_t max_extra_packets_to_check; u_int8_t num_extra_packets_checked; int (*extra_packets_func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow); /* the tcp / udp / other l4 value union used to reduce the number of bytes for tcp or udp protocol states */ union { struct ndpi_flow_tcp_struct tcp; struct ndpi_flow_udp_struct udp; } l4; /* Pointer to src or dst that identifies the server of this connection */ struct ndpi_id_struct *server_id; /* HTTP host or DNS query */ u_char host_server_name[256]; /* This structure below will not not stay inside the protos structure below as HTTP is used by many subprotocols such as FaceBook, Google... so it is hard to know when to use it or not. Thus we leave it outside for the time being. */ struct { ndpi_http_method method; char *url, *content_type; u_int8_t num_request_headers, num_response_headers; u_int8_t request_version; /* 0=1.0 and 1=1.1. Create an enum for this? */ u_char response_status_code[5]; /* 200, 404, etc. */ } http; union { /* the only fields useful for nDPI and ntopng */ struct { u_int8_t num_queries, num_answers, reply_code; u_int16_t query_type, query_class, rsp_type; } dns; struct { u_int8_t request_code; u_int8_t version; } ntp; struct { char client_certificate[48], server_certificate[48]; } ssl; struct { char client_signature[48], server_signature[48]; } ssh; struct { char answer[96]; } mdns; struct { char version[96]; } ubntac2; struct { /* Via HTTP User-Agent */ u_char detected_os[32]; /* Via HTTP X-Forwarded-For */ u_char nat_ip[24]; } http; struct { /* Bittorrent hash */ u_char hash[20]; } bittorrent; struct { char fingerprint[48]; char class_ident[48]; } dhcp; } protos; /*** ALL protocol specific 64 bit variables here ***/ /* protocols which have marked a connection as this connection cannot be protocol XXX, multiple u_int64_t */ NDPI_PROTOCOL_BITMASK excluded_protocol_bitmask; u_int8_t num_stun_udp_pkts; #ifdef NDPI_PROTOCOL_REDIS u_int8_t redis_s2d_first_char, redis_d2s_first_char; #endif u_int16_t packet_counter; // can be 0 - 65000 u_int16_t packet_direction_counter[2]; u_int16_t byte_counter[2]; #ifdef NDPI_PROTOCOL_BITTORRENT u_int8_t bittorrent_stage; // can be 0 - 255 #endif #ifdef NDPI_PROTOCOL_DIRECTCONNECT u_int32_t directconnect_stage:2; // 0 - 1 #endif #ifdef NDPI_PROTOCOL_SIP #ifdef NDPI_PROTOCOL_YAHOO u_int32_t sip_yahoo_voice:1; #endif #endif #ifdef NDPI_PROTOCOL_HTTP u_int32_t http_detected:1; #endif #ifdef NDPI_PROTOCOL_RTSP u_int32_t rtsprdt_stage:2; u_int32_t rtsp_control_flow:1; #endif #ifdef NDPI_PROTOCOL_YAHOO u_int32_t yahoo_detection_finished:2; #endif #ifdef NDPI_PROTOCOL_ZATTOO u_int32_t zattoo_stage:3; #endif #ifdef NDPI_PROTOCOL_QQ u_int32_t qq_stage:3; #endif #ifdef NDPI_PROTOCOL_THUNDER u_int32_t thunder_stage:2; // 0 - 3 #endif #ifdef NDPI_PROTOCOL_OSCAR u_int32_t oscar_ssl_voice_stage:3; u_int32_t oscar_video_voice:1; #endif #ifdef NDPI_PROTOCOL_FLORENSIA u_int32_t florensia_stage:1; #endif #ifdef NDPI_PROTOCOL_SOCKS u_int32_t socks5_stage:2; // 0 - 3 u_int32_t socks4_stage:2; // 0 - 3 #endif #ifdef NDPI_PROTOCOL_EDONKEY u_int32_t edonkey_stage:2; // 0 - 3 #endif #ifdef NDPI_PROTOCOL_FTP_CONTROL u_int32_t ftp_control_stage:2; #endif #ifdef NDPI_PROTOCOL_RTMP u_int32_t rtmp_stage:2; #endif #ifdef NDPI_PROTOCOL_PANDO u_int32_t pando_stage:3; #endif #ifdef NDPI_PROTOCOL_STEAM u_int32_t steam_stage:3; u_int32_t steam_stage1:3; // 0 - 4 u_int32_t steam_stage2:2; // 0 - 2 u_int32_t steam_stage3:2; // 0 - 2 #endif #ifdef NDPI_PROTOCOL_PPLIVE u_int32_t pplive_stage1:3; // 0 - 6 u_int32_t pplive_stage2:2; // 0 - 2 u_int32_t pplive_stage3:2; // 0 - 2 #endif #ifdef NDPI_PROTOCOL_STARCRAFT u_int32_t starcraft_udp_stage : 3; // 0-7 #endif #ifdef NDPI_PROTOCOL_OPENVPN u_int8_t ovpn_session_id[8]; u_int8_t ovpn_counter; #endif #ifdef NDPI_PROTOCOL_TINC u_int8_t tinc_state; struct tinc_cache_entry tinc_cache_entry; #endif #ifdef NDPI_PROTOCOL_CSGO u_int8_t csgo_strid[18],csgo_state,csgo_s2; u_int32_t csgo_id2; #endif #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI) u_int16_t kxun_counter, iqiyi_counter; #endif /* internal structures to save functions calls */ struct ndpi_packet_struct packet; struct ndpi_flow_struct *flow; struct ndpi_id_struct *src; struct ndpi_id_struct *dst; }; typedef struct { char *string_to_match, *proto_name; int protocol_id; ndpi_protocol_category_t proto_category; ndpi_protocol_breed_t protocol_breed; } ndpi_protocol_match; typedef struct { u_int32_t network; u_int8_t cidr; u_int8_t value; } ndpi_network; #endif/* __NDPI_TYPEDEFS_H__ */ nDPI-2.2/src/include/ndpi_unix.h000066400000000000000000000024221321103654100165230ustar00rootroot00000000000000/* * ndpi_unix.h * * Copyright (C) 2011-16 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_UNIX_INCLUDE_FILE__ #define __NDPI_UNIX_INCLUDE_FILE__ #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__OpenBSD__) #include #if defined(__NetBSD__) || defined(__OpenBSD__) #include #if defined(__OpenBSD__) #include #endif #endif #endif #ifndef WIN32 #include #include #include #endif #endif /* __NDPI_UNIX_INCLUDE_FILE__ */ nDPI-2.2/src/include/ndpi_win32.h000066400000000000000000000052121321103654100165020ustar00rootroot00000000000000/* * ndpi_win32.h * * Copyright (C) 2011-16 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef __NDPI_WIN32_H__ #define __NDPI_WIN32_H__ // fix a MinGW build issue "error: multiple storage classes in declaration specifiers" due to MinGW // defining extern for __forceinline types #if (defined(__MINGW32__) || defined(__MINGW64__)) && defined(__GNUC__) #define MINGW_GCC #define __mingw_forceinline __inline__ __attribute__((__always_inline__,__gnu_inline__)) #endif #include #include #include #include #include #include /* getopt from: http://www.pwilson.net/sample.html. */ #include /* for getpid() and the exec..() family */ #include #ifndef _CRT_SECURE_NO_WARNINGS #define _CRT_SECURE_NO_WARNINGS #endif #define _WS2TCPIP_H_ /* Avoid compilation problems */ #define IPVERSION 4 /* on *nix it is defined in netinet/ip.h */ extern char* strsep(char **sp, char *sep); typedef unsigned char u_char; typedef unsigned short u_short; typedef unsigned int uint; typedef unsigned long u_long; typedef u_char u_int8_t; typedef u_short u_int16_t; typedef uint u_int32_t; typedef uint u_int; typedef unsigned __int64 u_int64_t; #define pthread_t HANDLE #define pthread_mutex_t HANDLE #define pthread_rwlock_t pthread_mutex_t #define pthread_rwlock_init pthread_mutex_init #define pthread_rwlock_wrlock pthread_mutex_lock #define pthread_rwlock_rdlock pthread_mutex_lock #define pthread_rwlock_unlock pthread_mutex_unlock #define pthread_rwlock_destroy pthread_mutex_destroy #define gmtime_r(a, b) memcpy(b, gmtime(a), sizeof(struct tm)) #define in_addr_t unsigned long extern unsigned long waitForNextEvent(unsigned long ulDelay /* ms */); #define sleep(a /* sec */) waitForNextEvent(1000*a /* ms */) #endif /* __NDPI_WIN32_H__ */ nDPI-2.2/src/lib/000077500000000000000000000000001321103654100135005ustar00rootroot00000000000000nDPI-2.2/src/lib/Makefile.am000066400000000000000000000122321321103654100155340ustar00rootroot00000000000000lib_LTLIBRARIES = libndpi.la CFLAGS += -fPIC -DPIC # --coverage libndpi_la_CPPFLAGS = -I$(top_srcdir)/src/include/ -I$(top_srcdir)/src/lib/third_party/include/ libndpi_la_LDFLAGS = -version-info 1:0:0 -export-symbols $(top_srcdir)/libndpi.sym libndpi_la_includedir = $(includedir)/libndpi-@VERSION@/libndpi libndpi_la_include_HEADERS = ../include/ndpi_api.h \ ../include/ndpi_define.h \ ../include/ndpi_main.h \ ../include/ndpi_includes.h \ ../include/ndpi_protocol_ids.h \ ../include/ndpi_protocols.h \ ../include/ndpi_typedefs.h libndpi_la_SOURCES = ndpi_content_match.c.inc \ ndpi_main.c \ protocols/afp.c \ protocols/aimini.c \ protocols/applejuice.c \ protocols/armagetron.c \ protocols/ayiya.c \ protocols/amqp.c \ protocols/battlefield.c \ protocols/bgp.c \ protocols/bittorrent.c \ protocols/bjnp.c \ protocols/checkmk.c \ protocols/ciscovpn.c \ protocols/citrix.c \ protocols/coap.c \ protocols/collectd.c \ protocols/corba.c \ protocols/crossfire.c \ protocols/csgo.c \ protocols/dcerpc.c \ protocols/dhcp.c \ protocols/dhcpv6.c \ protocols/directconnect.c \ protocols/directdownloadlink.c \ protocols/dns.c \ protocols/dofus.c \ protocols/drda.c \ protocols/dropbox.c \ protocols/eaq.c \ protocols/edonkey.c \ protocols/fasttrack.c \ protocols/fiesta.c \ protocols/fix.c \ protocols/filetopia.c \ protocols/florensia.c \ protocols/ftp_control.c \ protocols/ftp_data.c \ protocols/git.c \ protocols/gnutella.c \ protocols/gtp.c \ protocols/guildwars.c \ protocols/hangout.c \ protocols/h323.c \ protocols/halflife2_and_mods.c \ protocols/hep.c \ protocols/http_activesync.c \ protocols/http.c \ protocols/iax.c \ protocols/icecast.c \ protocols/ipp.c \ protocols/irc.c \ protocols/jabber.c \ protocols/kakaotalk_voice.c \ protocols/kerberos.c \ protocols/kontiki.c \ protocols/ldap.c \ protocols/lotus_notes.c \ protocols/lisp.c \ protocols/mail_imap.c \ protocols/mail_pop.c \ protocols/mail_smtp.c \ protocols/maplestory.c \ protocols/mdns.c \ protocols/megaco.c \ protocols/mgcp.c \ protocols/mms.c \ protocols/mpegts.c \ protocols/mqtt.c \ protocols/msn.c \ protocols/mssql_tds.c \ protocols/mysql.c \ protocols/netbios.c \ protocols/netflow.c \ protocols/nintendo.c \ protocols/nfs.c \ protocols/noe.c \ protocols/non_tcp_udp.c \ protocols/ntp.c \ protocols/openft.c \ protocols/openvpn.c \ protocols/oracle.c \ protocols/oscar.c \ protocols/pando.c \ protocols/pcanywhere.c \ protocols/postgres.c \ protocols/pplive.c \ protocols/ppstream.c \ protocols/pptp.c \ protocols/qq.c \ protocols/quake.c \ protocols/quic.c \ protocols/radius.c \ protocols/rdp.c \ protocols/redis_net.c \ protocols/rsync.c \ protocols/rtcp.c \ protocols/rtmp.c \ protocols/rtp.c \ protocols/rtsp.c \ protocols/rx.c \ protocols/sflow.c \ protocols/shoutcast.c \ protocols/sip.c \ protocols/skinny.c \ protocols/skype.c \ protocols/smb.c \ protocols/snmp.c \ protocols/socks45.c \ protocols/socrates.c \ protocols/sopcast.c \ protocols/soulseek.c \ protocols/spotify.c \ protocols/ssdp.c \ protocols/ssh.c \ protocols/ssl.c \ protocols/starcraft.c \ protocols/stealthnet.c \ protocols/steam.c \ protocols/stun.c \ protocols/syslog.c \ protocols/tcp_udp.c \ protocols/teamspeak.c \ protocols/teamviewer.c \ protocols/telegram.c \ protocols/telnet.c \ protocols/tftp.c \ protocols/thunder.c \ protocols/tor.c \ protocols/teredo.c \ protocols/tvants.c \ protocols/tvuplayer.c \ protocols/ubntac2.c \ protocols/usenet.c \ protocols/viber.c \ protocols/vhua.c \ protocols/vmware.c \ protocols/vnc.c \ protocols/warcraft3.c \ protocols/whoisdas.c \ protocols/world_of_kung_fu.c \ protocols/world_of_warcraft.c \ protocols/xbox.c \ protocols/xdmcp.c \ protocols/yahoo.c \ protocols/zattoo.c \ protocols/zeromq.c \ protocols/smpp.c \ protocols/tinc.c \ protocols/someip.c \ third_party/include/actypes.h \ third_party/include/ahocorasick.h \ third_party/include/ndpi_patricia.h \ third_party/include/node.h \ third_party/include/sort.h \ third_party/include/libcache.h \ third_party/src/ahocorasick.c \ third_party/src/node.c \ third_party/src/sort.c \ third_party/src/libcache.c EXTRA_DIST = third_party/src/ndpi_patricia.c nDPI-2.2/src/lib/ndpi_content_match.c.inc000066400000000000000000020537421321103654100202710ustar00rootroot00000000000000/* * ndpi_content_match.c * * Copyright (C) 2011-2017 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* ****************************************************** */ static ndpi_network host_protocol_list[] = { /* SoundCloud */ { 0x22FB2FEE /* 34.251.47.238 */, 32, NDPI_PROTOCOL_SOUNDCLOUD }, { 0x23A06456 /* 35.160.100.86 */, 32, NDPI_PROTOCOL_SOUNDCLOUD }, { 0x36C0CA58 /* 54.192.202.88 */, 32, NDPI_PROTOCOL_SOUNDCLOUD }, /* Facebook, Inc. origin AS32934, AS54115 */ { 0x1F0D1800 /* 31.13.24.0/21 */, 21, NDPI_PROTOCOL_FACEBOOK }, { 0x1F0D4000 /* 31.13.64.0/18 */, 18, NDPI_PROTOCOL_FACEBOOK }, { 0x2D402800 /* 45.64.40.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, { 0x42DC9000 /* 66.220.144.0/20 */, 20, NDPI_PROTOCOL_FACEBOOK }, { 0x453FB000 /* 69.63.176.0/20 */, 20, NDPI_PROTOCOL_FACEBOOK }, { 0x45ABE000 /* 69.171.224.0/19 */, 19, NDPI_PROTOCOL_FACEBOOK }, { 0x4A774C00 /* 74.119.76.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, { 0x67046000 /* 103.4.96.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, { 0x81860000 /* 129.134.0.0/16 */, 16, NDPI_PROTOCOL_FACEBOOK }, { 0x9DF00000 /* 157.240.0.0/16 */, 16, NDPI_PROTOCOL_FACEBOOK }, { 0xADFC4000 /* 173.252.64.0/18 */, 18, NDPI_PROTOCOL_FACEBOOK }, { 0xB33CC000 /* 179.60.192.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, { 0xB93CD800 /* 185.60.216.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, { 0xC7C94000 /* 199.201.64.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, { 0xCC0F1400 /* 204.15.20.0/22 */, 22, NDPI_PROTOCOL_FACEBOOK }, /* Twitter Inc. origin AS13414, AS35995 */ { 0x0819C200 /* 8.25.194.0/23 */, 23, NDPI_PROTOCOL_TWITTER }, { 0x0819C400 /* 8.25.196.0/23 */, 23, NDPI_PROTOCOL_TWITTER }, { 0x450C3800 /* 69.12.56.0/21 */, 21, NDPI_PROTOCOL_TWITTER }, { 0x67FC7000 /* 103.252.112.0/22 */, 22, NDPI_PROTOCOL_TWITTER }, { 0x68F42800 /* 104.244.40.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0x68F42900 /* 104.244.41.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0x68F42A00 /* 104.244.42.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0x68F42B00 /* 104.244.43.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0x68F42C00 /* 104.244.44.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0x68F42D00 /* 104.244.45.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0x68F42E00 /* 104.244.46.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0x68F42F00 /* 104.244.47.0/24 */, 24, NDPI_PROTOCOL_TWITTER }, { 0xB92D0400 /* 185.45.4.0/23 */, 23, NDPI_PROTOCOL_TWITTER }, { 0xB92D0600 /* 185.45.6.0/23 */, 23, NDPI_PROTOCOL_TWITTER }, { 0xBC40E000 /* 188.64.224.0/21 */, 21, NDPI_PROTOCOL_TWITTER }, { 0xC02C4400 /* 192.44.68.0/23 */, 23, NDPI_PROTOCOL_TWITTER }, { 0xC030EC00 /* 192.48.236.0/23 */, 23, NDPI_PROTOCOL_TWITTER }, { 0xC0854C00 /* 192.133.76.0/22 */, 22, NDPI_PROTOCOL_TWITTER }, { 0xC7109C00 /* 199.16.156.0/22 */, 22, NDPI_PROTOCOL_TWITTER }, { 0xC73B9400 /* 199.59.148.0/22 */, 22, NDPI_PROTOCOL_TWITTER }, { 0xC7453A00 /* 199.69.58.0/23 */, 23, NDPI_PROTOCOL_TWITTER }, { 0xC7603800 /* 199.96.56.0/21 */, 21, NDPI_PROTOCOL_TWITTER }, { 0xCAA08000 /* 202.160.128.0/22 */, 22, NDPI_PROTOCOL_TWITTER }, /* WhatsApp Inc. */ { 0x3216C6CC /* 50.22.198.204/30 */, 30, NDPI_PROTOCOL_WHATSAPP }, { 0x4B7E2720 /* 75.126.39.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0x6CA8B460 /* 108.168.180.96/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0x9E553A00 /* 158.85.58.0/25 */, 25, NDPI_PROTOCOL_WHATSAPP }, { 0x9E55FE40 /* 158.85.254.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA92F2320 /* 169.47.35.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA93743E0 /* 169.55.67.224/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA93764A0 /* 169.55.100.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xA937EBA0 /* 169.55.235.160/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xADC0A220 /* 173.192.162.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xB8AD8840 /* 184.173.136.64/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xB93CDA35 /* 185.60.218.53/32 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xC60BFB20 /* 198.11.251.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xD02B73C0 /* 208.43.115.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, { 0xD02B7A80 /* 208.43.122.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP }, /* WeChat origin AS132203, AS132591, AS45090 */ { 0xCBCD93AB /* 203.205.147.171/32 */, 32, NDPI_PROTOCOL_WECHAT }, { 0xCBCD93AD /* 203.205.147.173/32 */, 32, NDPI_PROTOCOL_WECHAT }, { 0xCBCD97A2 /* 203.205.151.162/32 */, 32, NDPI_PROTOCOL_WECHAT }, { 0x67071E25 /* 103.7.30.37/32 */, 32, NDPI_PROTOCOL_WECHAT }, /* OpenDNS, LLC origin AS36692, AS30607 */ { 0x26631400 /* 38.99.20.0/23 */, 23, NDPI_PROTOCOL_OPENDNS }, { 0x3F504FC0 /* 63.80.79.192/26 */, 26, NDPI_PROTOCOL_OPENDNS }, { 0x43D74000 /* 67.215.64.0/19 */, 19, NDPI_PROTOCOL_OPENDNS }, { 0x92700000 /* 146.112.0.0/16 */, 16, NDPI_PROTOCOL_OPENDNS }, { 0xB93C5400 /* 185.60.84.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, { 0xB93C5500 /* 185.60.85.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, { 0xB93C5600 /* 185.60.86.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, { 0xB93C5700 /* 185.60.87.0/24 */, 24, NDPI_PROTOCOL_OPENDNS }, { 0xCCC2E800 /* 204.194.232.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, { 0xD043D800 /* 208.67.216.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, { 0xD0452000 /* 208.69.32.0/21 */, 21, NDPI_PROTOCOL_OPENDNS }, /* Microsoft Corporation (MS One Drive) */ { 0xCC4FC300 /* 204.79.195.0/24 */, 24, NDPI_PROTOCOL_MS_ONE_DRIVE }, { 0xCC4FC400 /* 204.79.196.0/23 */, 23, NDPI_PROTOCOL_MS_ONE_DRIVE }, { 0x86AA0000 /* 134.170.0.0/16 */, 16, NDPI_PROTOCOL_MS_ONE_DRIVE }, { 0x83FD0C00 /* 131.253.12.0/22 */, 22, NDPI_PROTOCOL_MS_ONE_DRIVE }, { 0x83FD1000 /* 131.253.16.0/23 */, 23, NDPI_PROTOCOL_MS_ONE_DRIVE }, { 0x83FD1200 /* 131.253.18.0/24 */, 24, NDPI_PROTOCOL_MS_ONE_DRIVE }, { 0x4136BF00 /* 65.54.191.0/24 */, 24, NDPI_PROTOCOL_MS_ONE_DRIVE }, /* Amazon.com, Inc. / Amazon Data Services Ireland Ltd origin AS16509, AS14618, AS7224, AS62785, AS8987 */ { 0x08129000 /* 8.18.144.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x08129100 /* 8.18.145.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x0D200000 /* 13.32.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x0D340000 /* 13.52.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x0D380000 /* 13.56.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x0D700000 /* 13.112.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x0D7C0000 /* 13.124.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x0DD00000 /* 13.208.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x0DE40000 /* 13.228.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x0DE80000 /* 13.232.0.0/13 */, 13, NDPI_PROTOCOL_AMAZON }, { 0x0DF80000 /* 13.248.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x17140000 /* 23.20.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x1B000000 /* 27.0.0.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x22C00000 /* 34.192.0.0/10 */, 10, NDPI_PROTOCOL_AMAZON }, { 0x23980000 /* 35.152.0.0/13 */, 13, NDPI_PROTOCOL_AMAZON }, { 0x23B00000 /* 35.176.0.0/13 */, 13, NDPI_PROTOCOL_AMAZON }, { 0x2BFAC000 /* 43.250.192.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x2BFAC100 /* 43.250.193.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x2E338000 /* 46.51.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x2E33C000 /* 46.51.192.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x2E33D800 /* 46.51.216.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x2E33E000 /* 46.51.224.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x2E890000 /* 46.137.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x2E898000 /* 46.137.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x2E89C000 /* 46.137.192.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x2E89E000 /* 46.137.224.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x32100000 /* 50.16.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x32700000 /* 50.112.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34000000 /* 52.0.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34020000 /* 52.2.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34040000 /* 52.4.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x34080000 /* 52.8.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34090000 /* 52.9.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x340A0000 /* 52.10.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x340C0000 /* 52.12.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x340E0000 /* 52.14.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34100000 /* 52.16.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34120000 /* 52.18.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34140000 /* 52.20.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x34180000 /* 52.24.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x341C0000 /* 52.28.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x341D0000 /* 52.29.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x341E0000 /* 52.30.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34200000 /* 52.32.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x34240000 /* 52.36.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x34280000 /* 52.40.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x342C0000 /* 52.44.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x342E0000 /* 52.46.0.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x342E5000 /* 52.46.80.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x342F0000 /* 52.47.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34300000 /* 52.48.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x34340000 /* 52.52.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34360000 /* 52.54.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34380000 /* 52.56.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34390000 /* 52.57.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x343A0000 /* 52.58.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x343C0000 /* 52.60.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x343E0000 /* 52.62.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34400000 /* 52.64.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34408000 /* 52.64.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34410000 /* 52.65.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34420000 /* 52.66.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34430000 /* 52.67.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34440000 /* 52.68.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34460000 /* 52.70.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34480000 /* 52.72.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x344A0000 /* 52.74.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x344C0000 /* 52.76.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x344C8000 /* 52.76.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x344D0000 /* 52.77.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x344E0000 /* 52.78.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x344F0000 /* 52.79.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x3452BB00 /* 52.82.187.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x34530000 /* 52.83.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x34540000 /* 52.84.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34560000 /* 52.86.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34580000 /* 52.88.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x345A0000 /* 52.90.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x345C0000 /* 52.92.0.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345C1000 /* 52.92.16.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345C2000 /* 52.92.32.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C2800 /* 52.92.40.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x345C3000 /* 52.92.48.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C3400 /* 52.92.52.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C3800 /* 52.92.56.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C3C00 /* 52.92.60.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C4000 /* 52.92.64.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C4400 /* 52.92.68.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C4800 /* 52.92.72.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C4C00 /* 52.92.76.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C5400 /* 52.92.84.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345C5800 /* 52.92.88.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345CF800 /* 52.92.248.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345CFC00 /* 52.92.252.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345D0000 /* 52.93.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x345E0000 /* 52.94.0.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345E0400 /* 52.94.4.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0500 /* 52.94.5.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0600 /* 52.94.6.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0700 /* 52.94.7.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0800 /* 52.94.8.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0900 /* 52.94.9.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0A00 /* 52.94.10.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0B00 /* 52.94.11.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0C00 /* 52.94.12.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0D00 /* 52.94.13.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0E00 /* 52.94.14.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E0F00 /* 52.94.15.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E1100 /* 52.94.17.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345E1800 /* 52.94.24.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345E1C00 /* 52.94.28.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345E2000 /* 52.94.32.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345E3000 /* 52.94.48.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345E4000 /* 52.94.64.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345E5000 /* 52.94.80.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345E6000 /* 52.94.96.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345E7000 /* 52.94.112.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345ECC00 /* 52.94.204.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345ECE00 /* 52.94.206.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345ED000 /* 52.94.208.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x345ED800 /* 52.94.216.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x345EE000 /* 52.94.224.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345EF000 /* 52.94.240.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345EFC00 /* 52.94.252.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345EFE00 /* 52.94.254.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345F0000 /* 52.95.0.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x345F0A00 /* 52.95.10.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345F0C00 /* 52.95.12.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F1000 /* 52.95.16.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x345F1800 /* 52.95.24.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F1E00 /* 52.95.30.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x345F2200 /* 52.95.34.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345F2300 /* 52.95.35.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345F2400 /* 52.95.36.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F3000 /* 52.95.48.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F3400 /* 52.95.52.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F3800 /* 52.95.56.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F4000 /* 52.95.64.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345F5000 /* 52.95.80.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345F6000 /* 52.95.96.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F6400 /* 52.95.100.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F6800 /* 52.95.104.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345F6F00 /* 52.95.111.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345F8000 /* 52.95.128.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x345FA000 /* 52.95.160.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x345FC000 /* 52.95.192.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0x345FD400 /* 52.95.212.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x345FE000 /* 52.95.224.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF000 /* 52.95.240.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF100 /* 52.95.241.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF200 /* 52.95.242.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF300 /* 52.95.243.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF400 /* 52.95.244.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF500 /* 52.95.245.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF600 /* 52.95.246.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF700 /* 52.95.247.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF800 /* 52.95.248.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FF900 /* 52.95.249.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FFA00 /* 52.95.250.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FFB00 /* 52.95.251.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FFC00 /* 52.95.252.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FFD00 /* 52.95.253.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x345FFE00 /* 52.95.254.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x34778000 /* 52.119.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x347C8000 /* 52.124.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34818000 /* 52.129.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34908000 /* 52.144.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34C00000 /* 52.192.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34C40000 /* 52.196.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x34C80000 /* 52.200.0.0/13 */, 13, NDPI_PROTOCOL_AMAZON }, { 0x34D00000 /* 52.208.0.0/13 */, 13, NDPI_PROTOCOL_AMAZON }, { 0x34D80000 /* 52.216.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34DA0000 /* 52.218.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34DA8000 /* 52.218.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34DB0000 /* 52.219.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34DB8000 /* 52.219.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34DC0000 /* 52.220.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x34DE0000 /* 52.222.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x34DE8000 /* 52.222.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36400000 /* 54.64.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36420000 /* 54.66.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36428000 /* 54.66.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36430000 /* 54.67.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36440000 /* 54.68.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36460000 /* 54.70.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36480000 /* 54.72.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36490000 /* 54.73.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x364A0000 /* 54.74.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x364C0000 /* 54.76.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x364E0000 /* 54.78.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x364F0000 /* 54.79.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x364F8000 /* 54.79.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36500000 /* 54.80.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x36540000 /* 54.84.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36560000 /* 54.86.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36570000 /* 54.87.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36580000 /* 54.88.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36590000 /* 54.89.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x365A0000 /* 54.90.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x365C0000 /* 54.92.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x365C8000 /* 54.92.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x365D0000 /* 54.93.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x365E0000 /* 54.94.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x365E8000 /* 54.94.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x365EC000 /* 54.94.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x365F0000 /* 54.95.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x365F8000 /* 54.95.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36900000 /* 54.144.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x36940000 /* 54.148.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36960000 /* 54.150.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36970000 /* 54.151.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36978000 /* 54.151.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36980000 /* 54.152.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36990000 /* 54.153.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36998000 /* 54.153.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x369A0000 /* 54.154.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x369B0000 /* 54.155.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x369C0000 /* 54.156.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x36A00000 /* 54.160.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x36A40000 /* 54.164.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36A60000 /* 54.166.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36A80000 /* 54.168.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36A90000 /* 54.169.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36A98000 /* 54.169.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36AA0000 /* 54.170.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36AB0000 /* 54.171.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36AC0000 /* 54.172.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36AE0000 /* 54.174.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36B00000 /* 54.176.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36B20000 /* 54.178.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36B28000 /* 54.178.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36B30000 /* 54.179.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36B38000 /* 54.179.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x36B3C000 /* 54.179.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x36B60000 /* 54.182.0.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x36B60800 /* 54.182.8.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x36B61000 /* 54.182.16.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x36B68000 /* 54.182.128.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B68200 /* 54.182.130.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B68400 /* 54.182.132.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B68600 /* 54.182.134.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B68800 /* 54.182.136.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B68A00 /* 54.182.138.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B68C00 /* 54.182.140.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B68E00 /* 54.182.142.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69000 /* 54.182.144.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69200 /* 54.182.146.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69400 /* 54.182.148.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69600 /* 54.182.150.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69800 /* 54.182.152.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69A00 /* 54.182.154.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69C00 /* 54.182.156.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B69E00 /* 54.182.158.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6A200 /* 54.182.162.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6A400 /* 54.182.164.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6A600 /* 54.182.166.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6A800 /* 54.182.168.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6AA00 /* 54.182.170.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6AE00 /* 54.182.174.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6B000 /* 54.182.176.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6B200 /* 54.182.178.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6B400 /* 54.182.180.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6B600 /* 54.182.182.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6B800 /* 54.182.184.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6BA00 /* 54.182.186.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6BF00 /* 54.182.191.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C000 /* 54.182.192.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C100 /* 54.182.193.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C200 /* 54.182.194.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C300 /* 54.182.195.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C400 /* 54.182.196.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C500 /* 54.182.197.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C600 /* 54.182.198.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C700 /* 54.182.199.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C800 /* 54.182.200.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6C900 /* 54.182.201.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6CA00 /* 54.182.202.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6CB00 /* 54.182.203.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6CC00 /* 54.182.204.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6CD00 /* 54.182.205.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6CE00 /* 54.182.206.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6CF00 /* 54.182.207.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D100 /* 54.182.209.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D200 /* 54.182.210.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D300 /* 54.182.211.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D400 /* 54.182.212.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D500 /* 54.182.213.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D600 /* 54.182.214.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D700 /* 54.182.215.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D800 /* 54.182.216.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6D900 /* 54.182.217.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6DA00 /* 54.182.218.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6DB00 /* 54.182.219.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6DC00 /* 54.182.220.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6DD00 /* 54.182.221.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6DE00 /* 54.182.222.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6DF00 /* 54.182.223.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6E000 /* 54.182.224.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6E200 /* 54.182.226.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6E400 /* 54.182.228.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6E600 /* 54.182.230.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6E700 /* 54.182.231.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6E800 /* 54.182.232.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6E900 /* 54.182.233.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6EA00 /* 54.182.234.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6EB00 /* 54.182.235.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6EC00 /* 54.182.236.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6ED00 /* 54.182.237.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6EE00 /* 54.182.238.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6EF00 /* 54.182.239.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6F000 /* 54.182.240.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6F200 /* 54.182.242.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6F300 /* 54.182.243.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6F400 /* 54.182.244.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6F500 /* 54.182.245.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6F600 /* 54.182.246.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6F800 /* 54.182.248.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6FA00 /* 54.182.250.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x36B6FC00 /* 54.182.252.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6FD00 /* 54.182.253.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6FE00 /* 54.182.254.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B6FF00 /* 54.182.255.0/24 */, 24, NDPI_PROTOCOL_AMAZON }, { 0x36B70000 /* 54.183.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36B78000 /* 54.183.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36B80000 /* 54.184.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36BA0000 /* 54.186.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36BC0000 /* 54.188.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36BE0000 /* 54.190.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36BF0000 /* 54.191.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36C00000 /* 54.192.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36C10000 /* 54.193.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36C18000 /* 54.193.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36C20000 /* 54.194.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36C30000 /* 54.195.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36C40000 /* 54.196.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36C60000 /* 54.198.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36C70000 /* 54.199.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36C78000 /* 54.199.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36C80000 /* 54.200.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36CA0000 /* 54.202.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36CC0000 /* 54.204.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36CE0000 /* 54.206.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36CE8000 /* 54.206.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36CF0000 /* 54.207.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36CF8000 /* 54.207.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36D00000 /* 54.208.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36D20000 /* 54.210.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36D30000 /* 54.211.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36D40000 /* 54.212.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36D50000 /* 54.213.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36D60000 /* 54.214.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36D68000 /* 54.214.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36D70000 /* 54.215.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36D78000 /* 54.215.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x36D7C000 /* 54.215.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x36D80000 /* 54.216.0.0/15 */, 15, NDPI_PROTOCOL_AMAZON }, { 0x36DA0000 /* 54.218.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36DA8000 /* 54.218.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36DB0000 /* 54.219.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x36DB8000 /* 54.219.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x36DBC000 /* 54.219.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x36DC0000 /* 54.220.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36DD0000 /* 54.221.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0x36DF2000 /* 54.223.32.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x36DF4000 /* 54.223.64.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x36E00000 /* 54.224.0.0/12 */, 12, NDPI_PROTOCOL_AMAZON }, { 0x36F00000 /* 54.240.0.0/12 */, 12, NDPI_PROTOCOL_AMAZON }, { 0x3F5C0C00 /* 63.92.12.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x3FEE0C00 /* 63.238.12.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x3FEE1000 /* 63.238.16.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x42074000 /* 66.7.64.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x43CA0000 /* 67.202.0.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0x4815C000 /* 72.21.192.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x482C2000 /* 72.44.32.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0x4B658000 /* 75.101.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x4F7D0000 /* 79.125.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x57EE5000 /* 87.238.80.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x607F0000 /* 96.127.0.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0x67040800 /* 103.4.8.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0x6708AC00 /* 103.8.172.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0x67F69400 /* 103.246.148.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x67F69600 /* 103.246.150.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0x6B140000 /* 107.20.0.0/14 */, 14, NDPI_PROTOCOL_AMAZON }, { 0x7AF8C000 /* 122.248.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xAC606000 /* 172.96.96.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0xAE810000 /* 174.129.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0xAF298000 /* 175.41.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xAF29C000 /* 175.41.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xB0204000 /* 176.32.64.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xB0206000 /* 176.32.96.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0xB0206800 /* 176.32.104.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0xB0207000 /* 176.32.112.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0xB0207800 /* 176.32.120.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0xB0207E00 /* 176.32.126.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0xB0220000 /* 176.34.0.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xB0222000 /* 176.34.32.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xB0224000 /* 176.34.64.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xB0228000 /* 176.34.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0xB1478000 /* 177.71.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0xB148F000 /* 177.72.240.0/21 */, 21, NDPI_PROTOCOL_AMAZON }, { 0xB2EC0000 /* 178.236.0.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, { 0xB8480000 /* 184.72.0.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xB8484000 /* 184.72.64.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xB8486000 /* 184.72.96.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xB8488000 /* 184.72.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0xB8490000 /* 184.73.0.0/16 */, 16, NDPI_PROTOCOL_AMAZON }, { 0xB8A98000 /* 184.169.128.0/17 */, 17, NDPI_PROTOCOL_AMAZON }, { 0xB9307800 /* 185.48.120.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0xB98F1000 /* 185.143.16.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0xC77FE800 /* 199.127.232.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0xC7FFC000 /* 199.255.192.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0xCB53DC00 /* 203.83.220.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0xCCEC8000 /* 204.236.128.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xCCECC000 /* 204.236.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xCCF6A000 /* 204.246.160.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xCDFBC000 /* 205.251.192.0/18 */, 18, NDPI_PROTOCOL_AMAZON }, { 0xCFABA000 /* 207.171.160.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xD02FF800 /* 208.47.248.0/23 */, 23, NDPI_PROTOCOL_AMAZON }, { 0xD1C96000 /* 209.201.96.0/22 */, 22, NDPI_PROTOCOL_AMAZON }, { 0xD8892000 /* 216.137.32.0/19 */, 19, NDPI_PROTOCOL_AMAZON }, { 0xD8B6E000 /* 216.182.224.0/20 */, 20, NDPI_PROTOCOL_AMAZON }, /* Netflix Inc. / Netflix Streaming Services Inc. origin AS2906, AS55095, AS40027 */ { 0x17F60000 /* 23.246.0.0/18 */, 18, NDPI_PROTOCOL_NETFLIX }, { 0x254DB800 /* 37.77.184.0/21 */, 21, NDPI_PROTOCOL_NETFLIX }, { 0x26487E00 /* 38.72.126.0/24 */, 24, NDPI_PROTOCOL_NETFLIX }, { 0x2D390000 /* 45.57.0.0/17 */, 17, NDPI_PROTOCOL_NETFLIX }, { 0x40788000 /* 64.120.128.0/17 */, 17, NDPI_PROTOCOL_NETFLIX }, { 0x42C58000 /* 66.197.128.0/17 */, 17, NDPI_PROTOCOL_NETFLIX }, { 0x4535E000 /* 69.53.224.0/19 */, 19, NDPI_PROTOCOL_NETFLIX }, { 0x6CAF2000 /* 108.175.32.0/20 */, 20, NDPI_PROTOCOL_NETFLIX }, { 0xB902DC00 /* 185.2.220.0/22 */, 22, NDPI_PROTOCOL_NETFLIX }, { 0xB909BC00 /* 185.9.188.0/22 */, 22, NDPI_PROTOCOL_NETFLIX }, { 0xC0AD4000 /* 192.173.64.0/18 */, 18, NDPI_PROTOCOL_NETFLIX }, { 0xC6266000 /* 198.38.96.0/19 */, 19, NDPI_PROTOCOL_NETFLIX }, { 0xC62D3000 /* 198.45.48.0/20 */, 20, NDPI_PROTOCOL_NETFLIX }, { 0xD04B4C00 /* 208.75.76.0/22 */, 22, NDPI_PROTOCOL_NETFLIX }, /* Cloudflare, Inc. origin AS13335, AS132892, AS203898, AS394536 */ { 0x4044C000 /* 64.68.192.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0x68100000 /* 104.16.0.0/12 */, 12, NDPI_PROTOCOL_CLOUDFLARE }, { 0x6CA2C000 /* 108.162.192.0/18 */, 18, NDPI_PROTOCOL_CLOUDFLARE }, { 0x8D654400 /* 141.101.68.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0x8D654500 /* 141.101.69.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0xA29E0000 /* 162.158.0.0/15 */, 15, NDPI_PROTOCOL_CLOUDFLARE }, { 0xA2FB5200 /* 162.251.82.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0xAC400000 /* 172.64.0.0/13 */, 13, NDPI_PROTOCOL_CLOUDFLARE }, { 0xADF53000 /* 173.245.48.0/20 */, 20, NDPI_PROTOCOL_CLOUDFLARE }, { 0xB97A0000 /* 185.122.0.0/22 */, 22, NDPI_PROTOCOL_CLOUDFLARE }, { 0xBC726000 /* 188.114.96.0/22 */, 22, NDPI_PROTOCOL_CLOUDFLARE }, { 0xBC726400 /* 188.114.100.0/22 */, 22, NDPI_PROTOCOL_CLOUDFLARE }, { 0xBC726800 /* 188.114.104.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0xBC726900 /* 188.114.105.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0xBC726A00 /* 188.114.106.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0xBC726B00 /* 188.114.107.0/24 */, 24, NDPI_PROTOCOL_CLOUDFLARE }, { 0xBC726C00 /* 188.114.108.0/22 */, 22, NDPI_PROTOCOL_CLOUDFLARE }, { 0xC6298000 /* 198.41.128.0/17 */, 17, NDPI_PROTOCOL_CLOUDFLARE }, { 0xC71B8000 /* 199.27.128.0/21 */, 21, NDPI_PROTOCOL_CLOUDFLARE }, /* OFFICE 365 */ { 0x0D6B0100 /* 13.107.1.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0300 /* 13.107.3.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0400 /* 13.107.4.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0500 /* 13.107.5.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0600 /* 13.107.6.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0700 /* 13.107.7.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0900 /* 13.107.9.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0C00 /* 13.107.12.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0D00 /* 13.107.13.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B0F00 /* 13.107.15.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, { 0x0D6B1000 /* 13.107.16.0 */, 24 , NDPI_PROTOCOL_OFFICE_365 }, /* OCS GO (Orange Cinéma Séries) */ { 0xB2F8D000 /* 178.248.208.0 */, 21, NDPI_PROTOCOL_OCS }, /* Teamviewer 159.122.189.32-63 */ { 0x9F7ABD30 /* 159.122.189.32 */, 21, NDPI_PROTOCOL_TEAMVIEWER }, /* IFLIX services -by www.vizuamatix.com R&D team */ { 0x344D0000 /* 52.77.0.0 */, 16, NDPI_PROTOCOL_IFLIX }, { 0x34DC0000 /* 52.220.0.0 */, 16, NDPI_PROTOCOL_IFLIX }, { 0x344A0000 /* 52.74.0.0 */, 16, NDPI_PROTOCOL_IFLIX }, { 0x36E69F00 /* 54.230.159.0 */, 24, NDPI_PROTOCOL_IFLIX }, { 0x36C09C50 /* 54.192.156.80 */, 32, NDPI_PROTOCOL_IFLIX }, { 0x36FBB6A8 /* 54.251.182.168 */, 32, NDPI_PROTOCOL_IFLIX }, { 0x36C09600 /* 54.192.150.0 */, 24, NDPI_PROTOCOL_IFLIX }, { 0x344AC0F7 /* 52.74.192.247 */, 32, NDPI_PROTOCOL_IFLIX }, { 0x0215E718 /* 2.21.231.24 */, 32, NDPI_PROTOCOL_IFLIX }, /* Citrix GotoMeeting (AS16815, AS21866) */ { 0xD873D000 /* 216.115.208.0 */, 20, NDPI_PROTOCOL_CITRIX_ONLINE }, { 0xD8DB7000 /* 216.219.112.0 */, 20, NDPI_PROTOCOL_CITRIX_ONLINE }, /* Cisco Webex LLC origin AS13445 */ { 0x0819C000 /* 8.25.192.0/24 */, 24, NDPI_PROTOCOL_WEBEX }, { 0x3E6DC000 /* 62.109.192.0/18 */, 18, NDPI_PROTOCOL_WEBEX }, { 0x40446000 /* 64.68.96.0/19 */, 19, NDPI_PROTOCOL_WEBEX }, { 0x4272A000 /* 66.114.160.0/20 */, 20, NDPI_PROTOCOL_WEBEX }, { 0x42A32000 /* 66.163.32.0/19 */, 19, NDPI_PROTOCOL_WEBEX }, { 0x721DC000 /* 114.29.192.0/19 */, 19, NDPI_PROTOCOL_WEBEX }, { 0xADF30000 /* 173.243.0.0/20 */, 20, NDPI_PROTOCOL_WEBEX }, { 0xCFB6A000 /* 207.182.160.0/19 */, 19, NDPI_PROTOCOL_WEBEX }, { 0xD0085100 /* 208.8.81.0/24 */, 24, NDPI_PROTOCOL_WEBEX }, { 0xD1C5C000 /* 209.197.192.0/19 */, 19, NDPI_PROTOCOL_WEBEX }, { 0xD204C000 /* 210.4.192.0/20 */, 20, NDPI_PROTOCOL_WEBEX }, /* Viber Media S.à r.l. https://whois.arin.net/rest/nets;q=AWS-VIBER-MEDIA?showDetails=true&showARIN=false&showNonArinTopLevelNet=false&ext=netref2 */ { 0x3400FC00 /* 52.0.252.0/22 */, 22, NDPI_PROTOCOL_VIBER }, { 0x3640BFF0 /* 54.64.191.240/28 */, 28, NDPI_PROTOCOL_VIBER }, { 0x36A5FFD0 /* 54.165.255.208/28 */, 28, NDPI_PROTOCOL_VIBER }, { 0x36A5FFE0 /* 54.165.255.224/27 */, 27, NDPI_PROTOCOL_VIBER }, { 0x36A93FA0 /* 54.169.63.160/27 */, 27, NDPI_PROTOCOL_VIBER }, { 0x36A93FC0 /* 54.169.63.192/26 */, 26, NDPI_PROTOCOL_VIBER }, { 0x36DBBFA0 /* 54.219.191.160/28 */, 28, NDPI_PROTOCOL_VIBER }, { 0x36E8FB90 /* 54.232.251.144/28 */, 28, NDPI_PROTOCOL_VIBER }, /* Apple Inc. origin AS714, AS6185 */ { 0x11000000 /* 17.0.0.0/8 */, 8, NDPI_PROTOCOL_APPLE }, { 0xC0233200 /* 192.35.50.0/24 */, 24, NDPI_PROTOCOL_APPLE }, { 0xC6B71000 /* 198.183.16.0/24 */, 24, NDPI_PROTOCOL_APPLE }, { 0xC6B71100 /* 198.183.17.0/24 */, 24, NDPI_PROTOCOL_APPLE }, { 0xCDB4AF00 /* 205.180.175.0/24 */, 24, NDPI_PROTOCOL_APPLE }, /* Dropbox, Inc. origin AS19679 */ { 0x2D3A4000 /* 45.58.64.0/20 */, 20, NDPI_PROTOCOL_DROPBOX }, { 0x6CA0A000 /* 108.160.160.0/20 */, 20, NDPI_PROTOCOL_DROPBOX }, { 0xA27D0000 /* 162.125.0.0/16 */, 16, NDPI_PROTOCOL_DROPBOX }, { 0xB92D0800 /* 185.45.8.0/22 */, 22, NDPI_PROTOCOL_DROPBOX }, { 0xC72FD800 /* 199.47.216.0/22 */, 22, NDPI_PROTOCOL_DROPBOX }, /* Skype (Microsoft CDN) */ { 0x9D388740 /* 157.56.135.64 */, 26, NDPI_PROTOCOL_SKYPE }, { 0x9D38B900 /* 157.56.185.0 */, 26, NDPI_PROTOCOL_SKYPE }, { 0x9D383400 /* 157.56.52.0 */, 26, NDPI_PROTOCOL_SKYPE }, { 0x9D383580 /* 157.56.53.128 */, 25, NDPI_PROTOCOL_SKYPE }, { 0x9D38C600 /* 157.56.198.0 */, 26, NDPI_PROTOCOL_SKYPE }, { 0x9D3C0000 /* 157.60.0.0 */, 16, NDPI_PROTOCOL_SKYPE }, { 0x9D360000 /* 157.54.0.0 */, 15, NDPI_PROTOCOL_SKYPE }, { 0x0D400000 /* 13.64.0.0 */, 11, NDPI_PROTOCOL_SKYPE }, { 0x0D6B0380 /* 13.107.3.128 */, 32, NDPI_PROTOCOL_SKYPE }, { 0x0D6B0381 /* 13.107.3.129 */, 32, NDPI_PROTOCOL_SKYPE }, { 0x6FDD4000 /* 111.221.64.0 */, 18, NDPI_PROTOCOL_SKYPE }, { 0x5BBED800 /* 91.190.216.0 */, 21, NDPI_PROTOCOL_SKYPE }, { 0x5BBEDA00 /* 91.190.218.0 */, 24, NDPI_PROTOCOL_SKYPE }, { 0x287F816D /* 40.126.129.109 */, 32, NDPI_PROTOCOL_SKYPE }, { 0x4237DF00 /* 65.55.223.0 */, 26, NDPI_PROTOCOL_SKYPE }, { 0x17600000 /* 23.96.0.0 */, 13, NDPI_PROTOCOL_SKYPE }, /* Blizzard Entertainment, Inc origin AS57976 */ { 0x052AA000 /* 5.42.160.0/19 */, 19, NDPI_PROTOCOL_STARCRAFT }, { 0x0C81DE00 /* 12.129.222.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, { 0x0C81E400 /* 12.129.228.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, { 0x0C81EC00 /* 12.129.236.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, { 0x0C81FE00 /* 12.129.254.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, { 0x0C82F400 /* 12.130.244.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, { 0x18690000 /* 24.105.0.0/18 */, 18, NDPI_PROTOCOL_STARCRAFT }, { 0x25F40000 /* 37.244.0.0/18 */, 18, NDPI_PROTOCOL_STARCRAFT }, { 0x3B992800 /* 59.153.40.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, { 0x3E73F400 /* 62.115.244.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, { 0x50EFD000 /* 80.239.208.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, { 0x67047200 /* 103.4.114.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, { 0x67C62000 /* 103.198.32.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, { 0x89DD4000 /* 137.221.64.0/18 */, 18, NDPI_PROTOCOL_STARCRAFT }, { 0xB93C7000 /* 185.60.112.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, { 0xC30CF400 /* 195.12.244.0/22 */, 22, NDPI_PROTOCOL_STARCRAFT }, { 0xC76C2000 /* 199.108.32.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT }, { 0xC76C3000 /* 199.108.48.0/20 */, 20, NDPI_PROTOCOL_STARCRAFT }, { 0xCA094200 /* 202.9.66.0/23 */, 23, NDPI_PROTOCOL_STARCRAFT }, /* Google Inc. / Google Switzerland GmbH / Google Ireland Limited origin AS15169, AS36384, AS41264, AS43515, AS36039, AS36040, AS36492 */ { 0x08063000 /* 8.6.48.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0x08080400 /* 8.8.4.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x08080800 /* 8.8.8.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x080FCA00 /* 8.15.202.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x0822D000 /* 8.34.208.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0x0822D800 /* 8.34.216.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0x0823C000 /* 8.35.192.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0x0823C800 /* 8.35.200.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0x17EC3000 /* 23.236.48.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0x17FB8000 /* 23.251.128.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0x23B80000 /* 35.184.0.0/13 */, 13, NDPI_PROTOCOL_GOOGLE }, { 0x2D79E400 /* 45.121.228.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x2D79E500 /* 45.121.229.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x2D79E600 /* 45.121.230.0/23 */, 23, NDPI_PROTOCOL_GOOGLE }, { 0x2E1CF700 /* 46.28.247.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x4009E000 /* 64.9.224.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0x400F7000 /* 64.15.112.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0x40E9A000 /* 64.233.160.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0x42660000 /* 66.102.0.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0x42F94000 /* 66.249.64.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0x46208000 /* 70.32.128.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0x480EC000 /* 72.14.192.0/18 */, 18, NDPI_PROTOCOL_GOOGLE }, { 0x4A721800 /* 74.114.24.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0x4A7D0000 /* 74.125.0.0/16 */, 16, NDPI_PROTOCOL_GOOGLE }, { 0x59CFE000 /* 89.207.224.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0x673E4000 /* 103.62.64.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x673E4100 /* 103.62.65.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0x673E4200 /* 103.62.66.0/23 */, 23, NDPI_PROTOCOL_GOOGLE }, { 0x68840000 /* 104.132.0.0/14 */, 14, NDPI_PROTOCOL_GOOGLE }, { 0x689A0000 /* 104.154.0.0/15 */, 15, NDPI_PROTOCOL_GOOGLE }, { 0x68C40000 /* 104.196.0.0/14 */, 14, NDPI_PROTOCOL_GOOGLE }, { 0x68EDA000 /* 104.237.160.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0x6BA7A000 /* 107.167.160.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0x6BB2C000 /* 107.178.192.0/18 */, 18, NDPI_PROTOCOL_GOOGLE }, { 0x6C3B5000 /* 108.59.80.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0x6CAAC000 /* 108.170.192.0/18 */, 18, NDPI_PROTOCOL_GOOGLE }, { 0x6CB10000 /* 108.177.0.0/17 */, 17, NDPI_PROTOCOL_GOOGLE }, { 0x71C56800 /* 113.197.104.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0x82D30000 /* 130.211.0.0/16 */, 16, NDPI_PROTOCOL_GOOGLE }, { 0x8EFA0000 /* 142.250.0.0/15 */, 15, NDPI_PROTOCOL_GOOGLE }, { 0x92940000 /* 146.148.0.0/17 */, 17, NDPI_PROTOCOL_GOOGLE }, { 0xA2D89400 /* 162.216.148.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0xA2DEB000 /* 162.222.176.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0xAC660800 /* 172.102.8.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0xAC6E2000 /* 172.110.32.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0xACD90000 /* 172.217.0.0/16 */, 16, NDPI_PROTOCOL_GOOGLE }, { 0xACFD0000 /* 172.253.0.0/16 */, 16, NDPI_PROTOCOL_GOOGLE }, { 0xADC20000 /* 173.194.0.0/16 */, 16, NDPI_PROTOCOL_GOOGLE }, { 0xADFF7000 /* 173.255.112.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0xB9191C00 /* 185.25.28.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0xB9969400 /* 185.150.148.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0xC068A000 /* 192.104.160.0/23 */, 23, NDPI_PROTOCOL_GOOGLE }, { 0xC0771C00 /* 192.119.28.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0xC09E1C00 /* 192.158.28.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0xC0B20000 /* 192.178.0.0/15 */, 15, NDPI_PROTOCOL_GOOGLE }, { 0xC1210400 /* 193.33.4.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0xC1210500 /* 193.33.5.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0xC1C8DE00 /* 193.200.222.0/24 */, 24, NDPI_PROTOCOL_GOOGLE }, { 0xC27A5000 /* 194.122.80.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0xC7C07000 /* 199.192.112.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0xC7DFE800 /* 199.223.232.0/21 */, 21, NDPI_PROTOCOL_GOOGLE }, { 0xCFDFA000 /* 207.223.160.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0xD0419800 /* 208.65.152.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, { 0xD075E000 /* 208.117.224.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0xD1558000 /* 209.85.128.0/17 */, 17, NDPI_PROTOCOL_GOOGLE }, { 0xD16BB000 /* 209.107.176.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0xD83AC000 /* 216.58.192.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0xD8495000 /* 216.73.80.0/20 */, 20, NDPI_PROTOCOL_GOOGLE }, { 0xD8EF2000 /* 216.239.32.0/19 */, 19, NDPI_PROTOCOL_GOOGLE }, { 0xD8FCDC00 /* 216.252.220.0/22 */, 22, NDPI_PROTOCOL_GOOGLE }, /* Canonical Ltd (Ubuntu) origin AS41231 */ { 0x5BBD5800 /* 91.189.88.0/21 */, 21, NDPI_PROTOCOL_UBUNTUONE }, { 0xA2D52000 /* 162.213.32.0/22 */, 22, NDPI_PROTOCOL_UBUNTUONE }, { 0xB97DBC00 /* 185.125.188.0/22 */, 22, NDPI_PROTOCOL_UBUNTUONE }, /* Telegram Messenger LLP origin: AS62041, AS62014, AS59930 */ { 0x5B6C0400 /* 91.108.4.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM }, { 0x5B6C0800 /* 91.108.8.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM }, { 0x5B6C0C00 /* 91.108.12.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM }, { 0x5B6C1000 /* 91.108.16.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM }, { 0x5B6C1400 /* 91.108.20.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM }, { 0x5B6C3800 /* 91.108.56.0/22 */, 22, NDPI_PROTOCOL_TELEGRAM }, { 0x959AA000 /* 149.154.160.0/20 */, 20, NDPI_PROTOCOL_TELEGRAM }, /* BitTorrent */ { 0xB9381424 /* 185.56.20.36/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0xC0DEED0A /* 192.222.237.10/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0x4DDEAE14 /* 77.222.174.20/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0x25779CBD /* 37.119.156.189/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0x05277C26 /* 5.39.124.38/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0x4FC0AB43 /* 79.192.171.67/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0xAC100010 /* 172.16.0.16/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0xB2A4F550 /* 178.164.245.80/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, { 0xAE597B3E /* 174.89.123.62/32 */, 32, NDPI_PROTOCOL_BITTORRENT }, /* Tor http://torstatus.blutmagie.de/ip_list_all.php/Tor_ip_list_ALL.csv From 02/17/2017 */ { 0x0122A339 /* 1.34.163.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x01EA0B8E /* 1.234.11.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x01F4E33D /* 1.244.227.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02054D8A /* 2.5.77.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x020A43F9 /* 2.10.67.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0246CA2B /* 2.70.202.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02565C41 /* 2.86.92.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x025C99E8 /* 2.92.153.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x025D0968 /* 2.93.9.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x025D1792 /* 2.93.23.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x025DCAEB /* 2.93.202.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x026C835B /* 2.108.131.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x026E3C44 /* 2.110.60.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x026EDB2F /* 2.110.219.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x026F5E2C /* 2.111.94.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x029B4710 /* 2.155.71.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02E18D86 /* 2.225.141.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02E1E75C /* 2.225.231.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02E58252 /* 2.229.130.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02E6A4FE /* 2.230.164.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02EC0943 /* 2.236.9.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02EC351D /* 2.236.53.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02EE4464 /* 2.238.68.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02F0439C /* 2.240.67.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02F0561B /* 2.240.86.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02F22990 /* 2.242.41.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02F2529C /* 2.242.82.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02F2AE32 /* 2.242.174.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x02F593C1 /* 2.245.147.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x041F4046 /* 4.31.64.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05015D72 /* 5.1.93.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05023698 /* 5.2.54.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050240D1 /* 5.2.64.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0502481A /* 5.2.72.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050249D9 /* 5.2.73.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05024A53 /* 5.2.74.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05080802 /* 5.8.8.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05090782 /* 5.9.7.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050907FC /* 5.9.7.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05090C1D /* 5.9.12.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509208F /* 5.9.32.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05092771 /* 5.9.39.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05092B03 /* 5.9.43.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05093254 /* 5.9.50.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05093A89 /* 5.9.58.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05093DCF /* 5.9.61.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05093E11 /* 5.9.62.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05093E49 /* 5.9.62.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050948E9 /* 5.9.72.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05094906 /* 5.9.73.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05094A3B /* 5.9.74.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05094F06 /* 5.9.79.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05094F9A /* 5.9.79.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05095129 /* 5.9.81.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050953CC /* 5.9.83.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509584A /* 5.9.88.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509622B /* 5.9.98.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050966C6 /* 5.9.102.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05096C58 /* 5.9.108.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05096EEC /* 5.9.110.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509794F /* 5.9.121.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050979CF /* 5.9.121.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050981DA /* 5.9.129.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05098C02 /* 5.9.140.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050992CB /* 5.9.146.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050993E2 /* 5.9.147.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05099564 /* 5.9.149.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05099628 /* 5.9.150.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050997F1 /* 5.9.151.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05099972 /* 5.9.153.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05099C11 /* 5.9.156.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05099E4B /* 5.9.158.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05099F0E /* 5.9.159.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509AB26 /* 5.9.171.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509BCBA /* 5.9.188.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509BF34 /* 5.9.191.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509C56A /* 5.9.197.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509D4CC /* 5.9.212.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0509FDEA /* 5.9.253.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050C14C2 /* 5.12.20.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x050F53EA /* 5.15.83.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0513A267 /* 5.19.162.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0513B3FD /* 5.19.179.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0513B825 /* 5.19.184.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x051C3E55 /* 5.28.62.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0522B45E /* 5.34.180.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0522B71A /* 5.34.183.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0522B781 /* 5.34.183.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0522B7CD /* 5.34.183.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0522B7D2 /* 5.34.183.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0523FBF7 /* 5.35.251.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052721B0 /* 5.39.33.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052721B2 /* 5.39.33.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05274007 /* 5.39.64.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05274DD0 /* 5.39.77.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05274E65 /* 5.39.78.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0527501C /* 5.39.80.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275087 /* 5.39.80.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275166 /* 5.39.81.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275199 /* 5.39.81.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052752C0 /* 5.39.82.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0527531B /* 5.39.83.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052753D9 /* 5.39.83.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052754D9 /* 5.39.84.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052756CE /* 5.39.86.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275835 /* 5.39.88.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275836 /* 5.39.88.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0527597C /* 5.39.89.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275CC7 /* 5.39.92.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275E3C /* 5.39.94.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275EA9 /* 5.39.94.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05275F8E /* 5.39.95.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05277C60 /* 5.39.124.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0527D90E /* 5.39.217.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052C65BE /* 5.44.101.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052D617F /* 5.45.97.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052D626F /* 5.45.98.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052D6416 /* 5.45.100.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052D6B38 /* 5.45.107.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052D6C30 /* 5.45.108.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x052D6D3E /* 5.45.109.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05313BF0 /* 5.49.59.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0531DE9D /* 5.49.222.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05336A6C /* 5.51.106.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0533CCF1 /* 5.51.204.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0533DC1E /* 5.51.220.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0533E534 /* 5.51.229.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0538203C /* 5.56.32.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05388513 /* 5.56.133.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x053D223F /* 5.61.34.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x053DEF22 /* 5.61.239.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x054D2F8E /* 5.77.47.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x054F44A1 /* 5.79.68.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x054F5482 /* 5.79.84.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x054F560F /* 5.79.86.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0550EAA9 /* 5.80.234.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0564FD98 /* 5.100.253.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0564FD99 /* 5.100.253.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05656652 /* 5.101.102.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05656746 /* 5.101.103.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05673A1E /* 5.103.58.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05685A1D /* 5.104.90.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05686A26 /* 5.104.106.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0581FAAD /* 5.129.250.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05871525 /* 5.135.21.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05874191 /* 5.135.65.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05877322 /* 5.135.115.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05879842 /* 5.135.152.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587988F /* 5.135.152.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05879B79 /* 5.135.155.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05879E65 /* 5.135.158.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05879F6E /* 5.135.159.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05879F80 /* 5.135.159.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587A231 /* 5.135.162.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587A2D9 /* 5.135.162.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587A34E /* 5.135.163.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587B2B8 /* 5.135.178.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587B5D0 /* 5.135.181.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587B5D5 /* 5.135.181.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587B682 /* 5.135.182.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587B818 /* 5.135.184.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587B991 /* 5.135.185.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587BA49 /* 5.135.186.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587BACD /* 5.135.186.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587BBC0 /* 5.135.187.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587BF33 /* 5.135.191.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0587C70D /* 5.135.199.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x058D09A4 /* 5.141.9.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05912EA6 /* 5.145.46.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05926255 /* 5.146.98.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05928E81 /* 5.146.142.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x059290E8 /* 5.146.144.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05930775 /* 5.147.7.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0593C4FC /* 5.147.196.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0593F89E /* 5.147.248.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0594A50D /* 5.148.165.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0594AF23 /* 5.148.175.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0594B430 /* 5.148.180.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0595FA33 /* 5.149.250.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0596CCB0 /* 5.150.204.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0596CCEF /* 5.150.204.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0596DD89 /* 5.150.221.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x059ABFAD /* 5.154.191.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05A4CC92 /* 5.164.204.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05A79A71 /* 5.167.154.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD357B /* 5.189.53.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD59E9 /* 5.189.89.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD844F /* 5.189.132.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD85F5 /* 5.189.133.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD8A09 /* 5.189.138.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD8C15 /* 5.189.140.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD8E76 /* 5.189.142.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD8F1C /* 5.189.143.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD8FA9 /* 5.189.143.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD9285 /* 5.189.146.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD995B /* 5.189.153.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD99B9 /* 5.189.153.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD9DE6 /* 5.189.157.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BD9F15 /* 5.189.159.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BDA4E6 /* 5.189.164.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BDAF34 /* 5.189.175.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BDB3A4 /* 5.189.179.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BDB53D /* 5.189.181.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BDB62D /* 5.189.182.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BDB83D /* 5.189.184.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05BDBC6F /* 5.189.188.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C40181 /* 5.196.1.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C40C4F /* 5.196.12.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C40E33 /* 5.196.14.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C41740 /* 5.196.23.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C42416 /* 5.196.36.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C43A60 /* 5.196.58.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C441AD /* 5.196.65.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C442A2 /* 5.196.66.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C442F1 /* 5.196.66.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C44562 /* 5.196.69.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C44718 /* 5.196.71.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C448E9 /* 5.196.72.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C45862 /* 5.196.88.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C45874 /* 5.196.88.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C45FEC /* 5.196.95.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C479A1 /* 5.196.121.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C4DE38 /* 5.196.222.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C4E3A1 /* 5.196.227.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C4EF72 /* 5.196.239.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C782BC /* 5.199.130.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C785C1 /* 5.199.133.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C78E70 /* 5.199.142.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C78E7C /* 5.199.142.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C78EC3 /* 5.199.142.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C78EEC /* 5.199.142.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C7957D /* 5.199.149.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C7A7CF /* 5.199.167.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05C81590 /* 5.200.21.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05E40CDD /* 5.228.12.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05E68950 /* 5.230.137.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05E69141 /* 5.230.145.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05E693CA /* 5.230.147.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05F991A4 /* 5.249.145.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05F99599 /* 5.249.149.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05F995CC /* 5.249.149.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05F99F6C /* 5.249.159.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05F99FC6 /* 5.249.159.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05F99FD1 /* 5.249.159.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05FF3D82 /* 5.255.61.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x05FF524B /* 5.255.82.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0818462C /* 8.24.70.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x081A5E12 /* 8.26.94.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x08250EDC /* 8.37.14.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0D447048 /* 13.68.112.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0D49A282 /* 13.73.162.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0D49A30F /* 13.73.163.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0D5076D2 /* 13.80.118.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0D5D7299 /* 13.93.114.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0E035769 /* 14.3.87.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0E035B2C /* 14.3.91.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0EC771B3 /* 14.199.113.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0ECA9DD9 /* 14.202.157.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x0ECAE631 /* 14.202.230.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x12520056 /* 18.82.0.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1252005E /* 18.82.0.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1252011D /* 18.82.1.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x12520388 /* 18.82.3.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x125203C4 /* 18.82.3.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x125203CD /* 18.82.3.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x12B50525 /* 18.181.5.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x12F80098 /* 18.248.0.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x12F80155 /* 18.248.1.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1751425A /* 23.81.66.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175B420B /* 23.91.66.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175B7C7C /* 23.91.124.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175BFEC8 /* 23.91.254.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175C1371 /* 23.92.19.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175C154A /* 23.92.21.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175C161D /* 23.92.22.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175C1B17 /* 23.92.27.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175C1C17 /* 23.92.28.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175E6595 /* 23.94.101.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175EEA32 /* 23.94.234.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175F092F /* 23.95.9.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x175F7105 /* 23.95.113.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1761ACE5 /* 23.97.172.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x176946AE /* 23.105.70.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17A30099 /* 23.163.0.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EE11E5 /* 23.238.17.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EF077E /* 23.239.7.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EF0A90 /* 23.239.10.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EF1613 /* 23.239.22.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EF1B1C /* 23.239.27.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EF1DE2 /* 23.239.29.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EF7165 /* 23.239.113.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17EF917D /* 23.239.145.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17F24468 /* 23.242.68.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FE8026 /* 23.254.128.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FEA584 /* 23.254.165.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FEA5FA /* 23.254.165.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FEA6DE /* 23.254.166.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FEA7B4 /* 23.254.167.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FEA7B9 /* 23.254.167.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FEA7E7 /* 23.254.167.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x17FFD782 /* 23.255.215.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18002A8B /* 24.0.42.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1803886A /* 24.3.136.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18066A49 /* 24.6.106.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1806AE5E /* 24.6.174.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1807B899 /* 24.7.184.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18084CAE /* 24.8.76.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1809B22E /* 24.9.178.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18129BCE /* 24.18.155.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x181430FC /* 24.20.48.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1815D5B4 /* 24.21.213.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1816F50B /* 24.22.245.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18228E69 /* 24.34.142.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18288F0E /* 24.40.143.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1835303E /* 24.53.48.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1838F948 /* 24.56.249.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x183FD72F /* 24.63.215.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x184D7389 /* 24.77.115.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18560435 /* 24.86.4.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x185D6D85 /* 24.93.109.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x185EB54F /* 24.94.181.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1860AD68 /* 24.96.173.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1860CED0 /* 24.96.206.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18631C64 /* 24.99.28.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18769E26 /* 24.118.158.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18794054 /* 24.121.64.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18821B00 /* 24.130.27.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1882DD76 /* 24.130.221.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18943BB9 /* 24.148.59.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18AB5048 /* 24.171.80.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18B2F2B4 /* 24.178.242.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18B7217A /* 24.183.33.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18BA6CF9 /* 24.186.108.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18BA6D04 /* 24.186.109.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18C1EF3E /* 24.193.239.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18CFD49A /* 24.207.212.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18D97413 /* 24.217.116.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18F635EB /* 24.246.53.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18F8CB31 /* 24.248.203.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x18FF2173 /* 24.255.33.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1B00EB39 /* 27.0.235.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1B04D4C5 /* 27.4.212.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F039A0D /* 31.3.154.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F0646E1 /* 31.6.70.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F068F3E /* 31.6.143.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F07B826 /* 31.7.184.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F0E8788 /* 31.14.135.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F0F42DA /* 31.15.66.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F103016 /* 31.16.48.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1059AA /* 31.16.89.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F105C19 /* 31.16.92.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F107B66 /* 31.16.123.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F10F410 /* 31.16.244.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F11002D /* 31.17.0.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F112C2D /* 31.17.44.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F113723 /* 31.17.55.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1139ED /* 31.17.57.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F11E73D /* 31.17.231.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F124F4B /* 31.18.79.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F132A0B /* 31.19.42.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F137AC6 /* 31.19.122.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F17C113 /* 31.23.193.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F189425 /* 31.24.148.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F18E3F0 /* 31.24.227.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F192C37 /* 31.25.44.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1CA8AE /* 31.28.168.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1F49DE /* 31.31.73.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1F4A2F /* 31.31.74.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1F4A45 /* 31.31.74.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1F4BB5 /* 31.31.75.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1F4CA9 /* 31.31.76.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1F4DB0 /* 31.31.77.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F1F4E31 /* 31.31.78.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F21B915 /* 31.33.185.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F22F15A /* 31.34.241.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F29DBE4 /* 31.41.219.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F2CE0ED /* 31.44.224.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F2CE638 /* 31.44.230.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F2D1035 /* 31.45.16.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F2FEE98 /* 31.47.238.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F360D08 /* 31.54.13.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F81A64E /* 31.129.166.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F82306D /* 31.130.48.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F8304A7 /* 31.131.4.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F83FB24 /* 31.131.251.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F849C88 /* 31.132.156.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F87F316 /* 31.135.243.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F87F38A /* 31.135.243.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1F978323 /* 31.151.131.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FA3F17E /* 31.163.241.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FA81163 /* 31.168.17.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FAA5229 /* 31.170.82.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FAA694D /* 31.170.105.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FAB9B1D /* 31.171.155.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FAB9B66 /* 31.171.155.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FAB9B6C /* 31.171.155.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FABF433 /* 31.171.244.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FAC56AD /* 31.172.86.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FB28B8A /* 31.178.139.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FB3842A /* 31.179.132.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FB91BCB /* 31.185.27.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FB96813 /* 31.185.104.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FB96814 /* 31.185.104.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FB96815 /* 31.185.104.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FC06297 /* 31.192.98.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FD008CB /* 31.208.8.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FD02929 /* 31.208.41.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FD047AD /* 31.208.71.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FD0687E /* 31.208.104.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FD0C9EC /* 31.208.201.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FD22183 /* 31.210.33.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FD69D53 /* 31.214.157.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FDC0599 /* 31.220.5.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FDC05C8 /* 31.220.5.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FDC07CD /* 31.220.7.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x1FDC1D7A /* 31.220.29.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x22C020B1 /* 34.192.32.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x22C16471 /* 34.193.100.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x22C55882 /* 34.197.88.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x22FA5400 /* 34.250.84.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x239C225F /* 35.156.34.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x239CF80C /* 35.156.248.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x23A1467D /* 35.161.70.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x23A32FF3 /* 35.163.47.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x23A436C1 /* 35.164.54.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x23A5B2E7 /* 35.165.178.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x23A75E0C /* 35.167.94.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x23B90E13 /* 35.185.14.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2437F33C /* 36.55.243.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x24E0398E /* 36.224.57.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2504ECD4 /* 37.4.236.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x250EC588 /* 37.14.197.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x250F704B /* 37.15.112.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x250F7AD8 /* 37.15.122.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2518C2C9 /* 37.24.194.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25223476 /* 37.34.52.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25236BEE /* 37.35.107.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25304971 /* 37.48.73.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253050B4 /* 37.48.80.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25307809 /* 37.48.120.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253078C4 /* 37.48.120.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25307A3C /* 37.48.122.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253A39E7 /* 37.58.57.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B0227 /* 37.59.2.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B0A65 /* 37.59.10.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B0E5E /* 37.59.14.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B253B /* 37.59.37.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B28C1 /* 37.59.40.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B2E9F /* 37.59.46.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B32DA /* 37.59.50.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B4884 /* 37.59.72.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B59D6 /* 37.59.89.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B6BB9 /* 37.59.107.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B7007 /* 37.59.112.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B76F6 /* 37.59.118.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253B7776 /* 37.59.119.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x253BFE09 /* 37.59.254.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x254E119E /* 37.78.17.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2561B974 /* 37.97.185.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x256E943B /* 37.110.148.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25719B64 /* 37.113.155.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25719FD5 /* 37.113.159.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25785989 /* 37.120.89.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2578A527 /* 37.120.165.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2578A9F3 /* 37.120.169.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2578ACF2 /* 37.120.172.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2578AD92 /* 37.120.173.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2578AEF9 /* 37.120.174.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2578B962 /* 37.120.185.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x257AD0DC /* 37.122.208.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x257B711D /* 37.123.113.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x257B8594 /* 37.123.133.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2582E385 /* 37.130.227.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2585166B /* 37.133.22.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x258B01D4 /* 37.139.1.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x258B0868 /* 37.139.8.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2599010A /* 37.153.1.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2599022C /* 37.153.2.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25992933 /* 37.153.41.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25993585 /* 37.153.53.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x259DC1A1 /* 37.157.193.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x259DC357 /* 37.157.195.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x259DC461 /* 37.157.196.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x259DC48E /* 37.157.196.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB0053 /* 37.187.0.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB011D /* 37.187.1.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB02AD /* 37.187.2.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB02E6 /* 37.187.2.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB036A /* 37.187.3.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB0408 /* 37.187.4.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB074A /* 37.187.7.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB1143 /* 37.187.17.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB115F /* 37.187.17.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB122B /* 37.187.18.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB126D /* 37.187.18.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB143B /* 37.187.20.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB144F /* 37.187.20.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB151C /* 37.187.21.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB159D /* 37.187.21.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB1657 /* 37.187.22.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB1683 /* 37.187.22.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB17A9 /* 37.187.23.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB17E8 /* 37.187.23.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB1E4E /* 37.187.30.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB1F27 /* 37.187.31.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB3F11 /* 37.187.63.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB4D34 /* 37.187.77.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB4ED2 /* 37.187.78.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB5A7A /* 37.187.90.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB5A95 /* 37.187.90.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB604E /* 37.187.96.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6054 /* 37.187.96.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6152 /* 37.187.97.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB615F /* 37.187.97.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB62B9 /* 37.187.98.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB658F /* 37.187.101.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB666C /* 37.187.102.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB66BA /* 37.187.102.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB66CA /* 37.187.102.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB679C /* 37.187.103.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB686F /* 37.187.104.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB68B2 /* 37.187.104.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB692B /* 37.187.105.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6941 /* 37.187.105.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6944 /* 37.187.105.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6968 /* 37.187.105.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6B5B /* 37.187.107.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6C50 /* 37.187.108.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6CD9 /* 37.187.108.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6E81 /* 37.187.110.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6ED8 /* 37.187.110.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB6FCD /* 37.187.111.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB732F /* 37.187.115.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB739D /* 37.187.115.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB7825 /* 37.187.120.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB7B79 /* 37.187.123.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BB82E2 /* 37.187.130.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BBB040 /* 37.187.176.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BBB102 /* 37.187.177.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BBB404 /* 37.187.180.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BBB412 /* 37.187.180.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BBB470 /* 37.187.180.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BBEF08 /* 37.187.239.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BC5335 /* 37.188.83.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BFC7AD /* 37.191.199.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BFE748 /* 37.191.231.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BFE8E4 /* 37.191.232.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25BFEC54 /* 37.191.236.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25C07417 /* 37.192.116.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25C86205 /* 37.200.98.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25C86275 /* 37.200.98.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25C863FB /* 37.200.99.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25CC3375 /* 37.204.51.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25CC834F /* 37.204.131.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25CD0983 /* 37.205.9.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25CD0A8C /* 37.205.10.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25CD0B95 /* 37.205.11.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25D11308 /* 37.209.19.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25D1771F /* 37.209.119.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DAF015 /* 37.218.240.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DAF032 /* 37.218.240.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DAF044 /* 37.218.240.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DAF050 /* 37.218.240.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DAF065 /* 37.218.240.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DAF7D9 /* 37.218.247.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DC1229 /* 37.220.18.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DC23CA /* 37.220.35.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DC24F0 /* 37.220.36.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDA2E2 /* 37.221.162.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDABEA /* 37.221.171.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDABEC /* 37.221.171.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDC108 /* 37.221.193.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDC1C3 /* 37.221.193.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDC41F /* 37.221.196.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDC489 /* 37.221.196.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25DDD301 /* 37.221.211.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25E48667 /* 37.228.134.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25E5D380 /* 37.229.211.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25E67725 /* 37.230.119.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25E9639D /* 37.233.99.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB30F7 /* 37.235.48.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB3122 /* 37.235.49.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB317C /* 37.235.49.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB318A /* 37.235.49.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB3443 /* 37.235.52.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB3753 /* 37.235.55.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB38B4 /* 37.235.56.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25EB3C4D /* 37.235.60.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25F72A79 /* 37.247.42.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25F733C5 /* 37.247.51.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x25FCBEB0 /* 37.252.190.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E5001C /* 38.229.0.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E5001D /* 38.229.0.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E54622 /* 38.229.70.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E5462B /* 38.229.70.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E54633 /* 38.229.70.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E54634 /* 38.229.70.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E54635 /* 38.229.70.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E54636 /* 38.229.70.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E5463D /* 38.229.70.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x26E54F02 /* 38.229.79.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x276E67D5 /* 39.110.103.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x294D88B2 /* 41.77.136.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x29B61914 /* 41.182.25.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x29B91CD6 /* 41.185.28.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x29CEBCCE /* 41.206.188.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x29D0D52E /* 41.208.213.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x29D7F232 /* 41.215.242.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x29DF358D /* 41.223.53.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x29E73565 /* 41.231.53.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2A024E0B /* 42.2.78.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2A70102A /* 42.112.16.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2A7010C2 /* 42.112.16.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2A7010C6 /* 42.112.16.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2A7010C8 /* 42.112.16.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2A7C24FC /* 42.124.36.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2BF00C3A /* 43.240.12.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2BF0633E /* 43.240.99.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2BFC250E /* 43.252.37.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D144301 /* 45.20.67.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D200159 /* 45.32.1.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D200322 /* 45.32.3.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D200C25 /* 45.32.12.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D201918 /* 45.32.25.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D201EB2 /* 45.32.30.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D203F93 /* 45.32.63.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D207501 /* 45.32.117.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D209255 /* 45.32.146.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D209749 /* 45.32.151.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D209CB3 /* 45.32.156.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D209FFD /* 45.32.159.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20B16B /* 45.32.177.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20BDB1 /* 45.32.189.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20D9B8 /* 45.32.217.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20E314 /* 45.32.227.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20E9BF /* 45.32.233.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20EDDB /* 45.32.237.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20EE3D /* 45.32.238.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20EE65 /* 45.32.238.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20EFA6 /* 45.32.239.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20F549 /* 45.32.245.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20F620 /* 45.32.246.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20F720 /* 45.32.247.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20F7E6 /* 45.32.247.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D20FA2E /* 45.32.250.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D211717 /* 45.33.23.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D212752 /* 45.33.39.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D2130CC /* 45.33.48.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D21395B /* 45.33.57.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D213D28 /* 45.33.61.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D21402D /* 45.33.64.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D214144 /* 45.33.65.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D214B1C /* 45.33.75.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D214D34 /* 45.33.77.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D2178C9 /* 45.33.120.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D228F04 /* 45.34.143.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D234855 /* 45.35.72.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D245B78 /* 45.36.91.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D25AAF2 /* 45.37.170.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D324D34 /* 45.50.77.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D370C17 /* 45.55.12.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D371384 /* 45.55.19.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D371B46 /* 45.55.27.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D373297 /* 45.55.50.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D37374C /* 45.55.55.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D373EA1 /* 45.55.62.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D376C6E /* 45.55.108.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D378127 /* 45.55.129.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3785F9 /* 45.55.133.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D37A05E /* 45.55.160.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D37A721 /* 45.55.167.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D37C2AF /* 45.55.194.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D37D4D9 /* 45.55.212.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D37EC13 /* 45.55.236.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D37F8E4 /* 45.55.248.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3A263B /* 45.58.38.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3A31FB /* 45.58.49.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3A34DD /* 45.58.52.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3A3C7F /* 45.58.60.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3E7420 /* 45.62.116.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3ECC76 /* 45.62.204.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3ED297 /* 45.62.210.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3ED2B0 /* 45.62.210.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3ED5FA /* 45.62.213.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EE196 /* 45.62.225.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EE1B7 /* 45.62.225.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EE23B /* 45.62.226.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EE30A /* 45.62.227.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EE459 /* 45.62.228.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EE814 /* 45.62.232.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EE8D4 /* 45.62.232.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EEBCA /* 45.62.235.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EEDEA /* 45.62.237.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF2C2 /* 45.62.242.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF3CC /* 45.62.243.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF4F0 /* 45.62.244.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF65B /* 45.62.246.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF684 /* 45.62.246.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF712 /* 45.62.247.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF71B /* 45.62.247.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF912 /* 45.62.249.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EF9C3 /* 45.62.249.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EFA42 /* 45.62.250.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EFC42 /* 45.62.252.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EFC48 /* 45.62.252.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EFC4C /* 45.62.252.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3EFD71 /* 45.62.253.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F0EE1 /* 45.63.14.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F185E /* 45.63.24.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F18E3 /* 45.63.24.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F19B3 /* 45.63.25.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F19EB /* 45.63.25.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F1A30 /* 45.63.26.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F1BC3 /* 45.63.27.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F1EA7 /* 45.63.30.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F2A5B /* 45.63.42.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F368F /* 45.63.54.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F4371 /* 45.63.67.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F4EB1 /* 45.63.78.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F54D9 /* 45.63.84.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F57EE /* 45.63.87.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F5935 /* 45.63.89.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F7760 /* 45.63.119.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F79B0 /* 45.63.121.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D3F7ED2 /* 45.63.126.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C154D /* 45.76.21.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C25E7 /* 45.76.37.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C26DB /* 45.76.38.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C5418 /* 45.76.84.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C5C75 /* 45.76.92.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C6B8C /* 45.76.107.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C6E2E /* 45.76.110.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C8322 /* 45.76.131.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C869F /* 45.76.134.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C9570 /* 45.76.149.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4C9CA5 /* 45.76.156.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F0AC3 /* 45.79.10.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F43ED /* 45.79.67.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F4CAE /* 45.79.76.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F582B /* 45.79.88.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F5B7E /* 45.79.91.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F5C5E /* 45.79.92.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F5FF4 /* 45.79.95.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F6365 /* 45.79.99.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F6C60 /* 45.79.108.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F6D37 /* 45.79.109.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F6F7C /* 45.79.111.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F8A08 /* 45.79.138.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4F92E3 /* 45.79.146.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4FB872 /* 45.79.184.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4FBA2B /* 45.79.186.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4FC4D3 /* 45.79.196.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4FCFB0 /* 45.79.207.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D4FD7B0 /* 45.79.215.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D7AFD06 /* 45.122.253.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D7B7665 /* 45.123.118.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2D7BBE74 /* 45.123.190.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E040059 /* 46.4.0.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E041343 /* 46.4.19.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E0422F2 /* 46.4.34.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E04268B /* 46.4.38.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E042843 /* 46.4.40.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E042DBC /* 46.4.45.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E0431C9 /* 46.4.49.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E0437B1 /* 46.4.55.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E043997 /* 46.4.57.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E043A5A /* 46.4.58.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E044E03 /* 46.4.78.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E045131 /* 46.4.81.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E046723 /* 46.4.103.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E046F7C /* 46.4.111.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E047AAD /* 46.4.122.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E047D02 /* 46.4.125.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E04803E /* 46.4.128.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E049051 /* 46.4.144.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E04AE34 /* 46.4.174.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E04FDC2 /* 46.4.253.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E0528D2 /* 46.5.40.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E05DE6A /* 46.5.222.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E05E9A1 /* 46.5.233.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E05EF26 /* 46.5.239.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E075A45 /* 46.7.90.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E07F1E0 /* 46.7.241.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E09C314 /* 46.9.195.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E0EF5CE /* 46.14.245.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E10EA83 /* 46.16.234.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E113FD6 /* 46.17.63.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E135DD4 /* 46.19.93.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E135DD6 /* 46.19.93.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E135DD8 /* 46.19.93.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E142372 /* 46.20.35.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E14F677 /* 46.20.246.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E16D163 /* 46.22.209.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E16D4E6 /* 46.22.212.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1746C3 /* 46.23.70.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E174851 /* 46.23.72.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E17551F /* 46.23.85.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C40EA /* 46.28.64.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C449D /* 46.28.68.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C449E /* 46.28.68.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C5621 /* 46.28.86.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C6B52 /* 46.28.107.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C6DE7 /* 46.28.109.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C6E88 /* 46.28.110.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1C6EF4 /* 46.28.110.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCAFE /* 46.28.202.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCDAA /* 46.28.205.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCDBB /* 46.28.205.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCE7E /* 46.28.206.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCF13 /* 46.28.207.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCF3A /* 46.28.207.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCF6B /* 46.28.207.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1CCF8D /* 46.28.207.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E1DF8EE /* 46.29.248.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E242549 /* 46.36.37.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E242786 /* 46.36.39.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E259D1F /* 46.37.157.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26300C /* 46.38.48.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E2630E1 /* 46.38.48.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E263312 /* 46.38.51.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E2638D5 /* 46.38.56.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26E7D1 /* 46.38.231.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26E9F2 /* 46.38.233.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26EA9E /* 46.38.234.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26EC11 /* 46.38.236.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26EDDD /* 46.38.237.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26EE84 /* 46.38.238.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26F110 /* 46.38.241.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E26FA27 /* 46.38.250.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E27E388 /* 46.39.227.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E27FB57 /* 46.39.251.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E2901A7 /* 46.41.1.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E293BDF /* 46.41.59.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E298244 /* 46.41.130.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E298454 /* 46.41.132.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E29964A /* 46.41.150.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E2D0F7B /* 46.45.15.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E3B489D /* 46.59.72.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E3B6325 /* 46.59.99.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E3B8535 /* 46.59.133.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E3BB9CE /* 46.59.185.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E3BC7B0 /* 46.59.199.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E3BD83E /* 46.59.216.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E491002 /* 46.73.16.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E49B49E /* 46.73.180.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E53768C /* 46.83.118.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E541269 /* 46.84.18.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E5443ED /* 46.84.67.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E566304 /* 46.86.99.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E59D7A4 /* 46.89.215.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E59D8D6 /* 46.89.216.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E5B6737 /* 46.91.103.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E650933 /* 46.101.9.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65158F /* 46.101.21.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E6515C9 /* 46.101.21.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E6547B6 /* 46.101.71.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E655FEF /* 46.101.95.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E656647 /* 46.101.102.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E6568F5 /* 46.101.104.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E657F91 /* 46.101.127.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E658A2E /* 46.101.138.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E658B87 /* 46.101.139.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E658BF8 /* 46.101.139.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E658D0F /* 46.101.141.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E658EAE /* 46.101.142.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E659569 /* 46.101.149.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E659631 /* 46.101.150.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E6597DE /* 46.101.151.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E659893 /* 46.101.152.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65A613 /* 46.101.166.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65A997 /* 46.101.169.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65B2BE /* 46.101.178.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65B7A0 /* 46.101.183.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65C0E6 /* 46.101.192.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65CAE7 /* 46.101.202.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65CE81 /* 46.101.206.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65D847 /* 46.101.216.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65DFE7 /* 46.101.223.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E65E72C /* 46.101.231.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E691DC8 /* 46.105.29.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E693F2C /* 46.105.63.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E6954B2 /* 46.105.84.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E696495 /* 46.105.100.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E69E36D /* 46.105.227.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E6C27DB /* 46.108.39.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E77FDF4 /* 46.119.253.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E7E0EBC /* 46.126.14.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E7F0C21 /* 46.127.12.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E7FA71E /* 46.127.167.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E803C3C /* 46.128.60.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E80720C /* 46.128.114.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E80C733 /* 46.128.199.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E8E51C0 /* 46.142.81.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E92F7A7 /* 46.146.247.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E941222 /* 46.148.18.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E941342 /* 46.148.19.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E941A6C /* 46.148.26.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E971AC2 /* 46.151.26.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2E971B65 /* 46.151.27.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA102E0 /* 46.161.2.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA1924B /* 46.161.146.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA2C0A6 /* 46.162.192.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA34CAA /* 46.163.76.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA34E0E /* 46.163.78.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA4DA09 /* 46.164.218.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA4F360 /* 46.164.243.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5C560 /* 46.165.197.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5D64D /* 46.165.214.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5DDA6 /* 46.165.221.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5DFD9 /* 46.165.223.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5E605 /* 46.165.230.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5F2A6 /* 46.165.242.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5F9D1 /* 46.165.249.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5FAE0 /* 46.165.250.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5FDA4 /* 46.165.253.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5FDB4 /* 46.165.253.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA5FE28 /* 46.165.254.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6948E /* 46.166.148.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6948F /* 46.166.148.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA69490 /* 46.166.148.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA69491 /* 46.166.148.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA69492 /* 46.166.148.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA69498 /* 46.166.148.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA69499 /* 46.166.148.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6949A /* 46.166.148.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6949B /* 46.166.148.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA694B0 /* 46.166.148.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA694B1 /* 46.166.148.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A049 /* 46.166.160.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A222 /* 46.166.162.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A235 /* 46.166.162.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A372 /* 46.166.163.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A378 /* 46.166.163.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A512 /* 46.166.165.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A576 /* 46.166.165.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A581 /* 46.166.165.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6A72E /* 46.166.167.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA6AD65 /* 46.166.173.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EA7F533 /* 46.167.245.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EAD2695 /* 46.173.38.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB6121D /* 46.182.18.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB6126F /* 46.182.18.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB612D6 /* 46.182.18.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB612DF /* 46.182.18.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB612F5 /* 46.182.18.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB61397 /* 46.182.19.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB613DB /* 46.182.19.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB613E7 /* 46.182.19.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB66ABE /* 46.182.106.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB6D01C /* 46.182.208.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB7D8CD /* 46.183.216.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB7D8E0 /* 46.183.216.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB7DAC6 /* 46.183.218.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB7DAC7 /* 46.183.218.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB7DD89 /* 46.183.221.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EB7DDE7 /* 46.183.221.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EBB039C /* 46.187.3.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EBC02E4 /* 46.188.2.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EBC0425 /* 46.188.4.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EBC2C19 /* 46.188.44.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EBC389E /* 46.188.56.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EC20F5D /* 46.194.15.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2ECE6DDD /* 46.206.109.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EDB020C /* 46.219.2.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EDF5011 /* 46.223.80.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EDF6387 /* 46.223.99.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EE343B5 /* 46.227.67.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EE360DA /* 46.227.96.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EE412ED /* 46.228.18.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EE5ADEB /* 46.229.173.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EE5EEAC /* 46.229.238.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EE90046 /* 46.233.0.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EEBE346 /* 46.235.227.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EEF6CC2 /* 46.239.108.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF48887 /* 46.244.136.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF4E6CC /* 46.244.230.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF62AEC /* 46.246.42.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF62B6B /* 46.246.43.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF631CF /* 46.246.49.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF659A9 /* 46.246.89.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF65D46 /* 46.246.93.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF91507 /* 46.249.21.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF9256D /* 46.249.37.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF9258F /* 46.249.37.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF93147 /* 46.249.49.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF93167 /* 46.249.49.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EF931E7 /* 46.249.49.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EFC1838 /* 46.252.24.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EFC19F9 /* 46.252.25.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2EFC1A02 /* 46.252.26.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F10B998 /* 47.16.185.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F340306 /* 47.52.3.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F3770E4 /* 47.55.112.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F580304 /* 47.88.3.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F580560 /* 47.88.5.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F580626 /* 47.88.6.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F580B9E /* 47.88.11.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F580C0E /* 47.88.12.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F5812DA /* 47.88.18.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F581674 /* 47.88.22.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F581BA1 /* 47.88.27.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F581C38 /* 47.88.28.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F58BCD1 /* 47.88.188.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F58C22F /* 47.88.194.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F58F20C /* 47.88.242.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F5921A9 /* 47.89.33.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F93BE47 /* 47.147.190.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F946A1D /* 47.148.106.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F96A641 /* 47.150.166.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2F98E3B8 /* 47.152.227.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2FB85DF1 /* 47.184.93.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2FBE0902 /* 47.190.9.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2FC7F0D4 /* 47.199.240.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2FCA878C /* 47.202.135.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x2FDD0406 /* 47.221.4.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x31030B7A /* 49.3.11.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x31D4A626 /* 49.212.166.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32013381 /* 50.1.51.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207730C /* 50.7.115.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32077343 /* 50.7.115.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32079720 /* 50.7.151.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207972F /* 50.7.151.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207977F /* 50.7.151.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207A1DA /* 50.7.161.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207B002 /* 50.7.176.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207B222 /* 50.7.178.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207B262 /* 50.7.178.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207B292 /* 50.7.178.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207B3CA /* 50.7.179.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207B3FB /* 50.7.179.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207B83A /* 50.7.184.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3207BA26 /* 50.7.186.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x321A02E8 /* 50.26.2.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x321E240F /* 50.30.36.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x321E2412 /* 50.30.36.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x321F70E7 /* 50.31.112.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x321FFC0B /* 50.31.252.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x321FFC2B /* 50.31.252.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32277A27 /* 50.39.122.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3227A54D /* 50.39.165.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x322E6D89 /* 50.46.109.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x322E7DA7 /* 50.46.125.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3235472D /* 50.53.71.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3235B52D /* 50.53.181.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3241A4B3 /* 50.65.164.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3242552D /* 50.66.85.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32428A4C /* 50.66.138.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x324C3161 /* 50.76.49.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x324C9FDA /* 50.76.159.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3258B15A /* 50.88.177.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3265F0E0 /* 50.101.240.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3273A471 /* 50.115.164.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32740095 /* 50.116.0.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x327403DF /* 50.116.3.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3274046B /* 50.116.4.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3274048D /* 50.116.4.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32740599 /* 50.116.5.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32740740 /* 50.116.7.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32740F49 /* 50.116.15.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x327415AC /* 50.116.21.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32741DB3 /* 50.116.29.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32742806 /* 50.116.40.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x327428E2 /* 50.116.40.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32742AF5 /* 50.116.42.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32743085 /* 50.116.48.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3274312E /* 50.116.49.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32743830 /* 50.116.56.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32808C86 /* 50.128.140.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3286A971 /* 50.134.169.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3287AAFC /* 50.135.170.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3288C5FD /* 50.136.197.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32894E81 /* 50.137.78.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x328AA937 /* 50.138.169.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32967772 /* 50.150.119.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32972D07 /* 50.151.45.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x329F7E15 /* 50.159.126.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32A11710 /* 50.161.23.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32A2D76C /* 50.162.215.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32A56D5B /* 50.165.109.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32AA0CB8 /* 50.170.12.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32AF9CE1 /* 50.175.156.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32B12972 /* 50.177.41.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32BBD74E /* 50.187.215.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32C113B2 /* 50.193.19.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32C18F2A /* 50.193.143.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32C1CA26 /* 50.193.202.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32F38312 /* 50.243.131.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32F4C8DD /* 50.244.200.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32F7C37C /* 50.247.195.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32F7F8AC /* 50.247.248.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x32FAC9FE /* 50.250.201.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3306168B /* 51.6.22.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F017D /* 51.15.1.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F040A /* 51.15.4.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F040D /* 51.15.4.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F0437 /* 51.15.4.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2495 /* 51.15.36.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F24A4 /* 51.15.36.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F24AC /* 51.15.36.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F24B7 /* 51.15.36.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F24CE /* 51.15.36.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F253B /* 51.15.37.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2561 /* 51.15.37.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F260D /* 51.15.38.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2637 /* 51.15.38.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F263A /* 51.15.38.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2702 /* 51.15.39.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F28E9 /* 51.15.40.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2A13 /* 51.15.42.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2BCA /* 51.15.43.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2BCD /* 51.15.43.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2C36 /* 51.15.44.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2C8E /* 51.15.44.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2CFB /* 51.15.44.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2E0F /* 51.15.46.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2E2D /* 51.15.46.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2E8E /* 51.15.46.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F2F3E /* 51.15.47.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3095 /* 51.15.48.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F30FC /* 51.15.48.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F30FE /* 51.15.48.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3108 /* 51.15.49.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3224 /* 51.15.50.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F326D /* 51.15.50.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F32C0 /* 51.15.50.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F339C /* 51.15.51.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F339F /* 51.15.51.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3410 /* 51.15.52.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3478 /* 51.15.52.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F34F4 /* 51.15.52.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F354B /* 51.15.53.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3553 /* 51.15.53.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3576 /* 51.15.53.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F37F5 /* 51.15.55.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3865 /* 51.15.56.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3957 /* 51.15.57.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3A69 /* 51.15.58.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3A98 /* 51.15.58.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3BDF /* 51.15.59.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3C66 /* 51.15.60.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3D03 /* 51.15.61.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3D49 /* 51.15.61.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3E82 /* 51.15.62.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F3EFC /* 51.15.62.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F8767 /* 51.15.135.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F8BC8 /* 51.15.139.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F8F11 /* 51.15.143.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x330F8FEF /* 51.15.143.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x338D06FA /* 51.141.6.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33AEC575 /* 51.174.197.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33AF32A2 /* 51.175.50.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33AF77B7 /* 51.175.119.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE17CB /* 51.254.23.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE2397 /* 51.254.35.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE26F9 /* 51.254.38.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE305D /* 51.254.48.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE3D41 /* 51.254.61.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE5640 /* 51.254.86.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE6376 /* 51.254.99.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE65F2 /* 51.254.101.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE6670 /* 51.254.102.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE7034 /* 51.254.112.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE73E1 /* 51.254.115.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE7404 /* 51.254.116.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE7852 /* 51.254.120.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE793F /* 51.254.121.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE80C9 /* 51.254.128.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE83E2 /* 51.254.131.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE87D5 /* 51.254.135.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FE88C3 /* 51.254.136.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FEA432 /* 51.254.164.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FEAF54 /* 51.254.175.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FED1C5 /* 51.254.209.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FED906 /* 51.254.217.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FEDAF7 /* 51.254.218.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FEDD90 /* 51.254.221.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FEE104 /* 51.254.225.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FEF6CB /* 51.254.246.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FF28E3 /* 51.255.40.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FF2941 /* 51.255.41.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FF295B /* 51.255.41.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FF2CB7 /* 51.255.44.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FF304E /* 51.255.48.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FF4B03 /* 51.255.75.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FF63C7 /* 51.255.99.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FFA888 /* 51.255.168.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FFA90A /* 51.255.169.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FFC64D /* 51.255.198.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FFCA42 /* 51.255.202.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FFCE4A /* 51.255.206.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FFD302 /* 51.255.211.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x33FFD3EB /* 51.255.211.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34060992 /* 52.6.9.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x340A7D8C /* 52.10.125.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34108E2D /* 52.16.142.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3412C7EF /* 52.18.199.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x341363E8 /* 52.19.99.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34230B02 /* 52.35.11.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3424553A /* 52.36.85.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3427F366 /* 52.39.243.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x342A5EC8 /* 52.42.94.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x343229E9 /* 52.50.41.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34382A18 /* 52.56.42.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34387CCC /* 52.56.124.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x343B3716 /* 52.59.55.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x343F8694 /* 52.63.134.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3441CBF7 /* 52.65.203.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34424F66 /* 52.66.79.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3442757E /* 52.66.117.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3442987F /* 52.66.152.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3443BC29 /* 52.67.188.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x345A5415 /* 52.90.84.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x345ACE83 /* 52.90.206.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x345BE3FB /* 52.91.227.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34A6C0B4 /* 52.166.192.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34A90A5A /* 52.169.10.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34B72F9B /* 52.183.47.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34B89DEA /* 52.184.157.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D1200B /* 52.209.32.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D18505 /* 52.209.133.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D2A92C /* 52.210.169.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D355CD /* 52.211.85.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D38C46 /* 52.211.140.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D5740C /* 52.213.116.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D62D93 /* 52.214.45.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x34D67041 /* 52.214.112.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36546A29 /* 54.84.106.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36559EBB /* 54.85.158.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3656E88C /* 54.86.232.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x365DB1D9 /* 54.93.177.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x365E55C9 /* 54.94.85.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x365E660F /* 54.94.102.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x369F547E /* 54.159.84.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36A148CC /* 54.161.72.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36A6BADA /* 54.166.186.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36B362CC /* 54.179.98.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36BA1A45 /* 54.186.26.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36BA3003 /* 54.186.48.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36BA6869 /* 54.186.104.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36BBEF10 /* 54.187.239.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36C422BD /* 54.196.34.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36C51CD3 /* 54.197.28.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36C9C95D /* 54.201.201.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36D3D06C /* 54.211.208.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36D95C38 /* 54.217.92.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36DAAC00 /* 54.218.172.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36E44160 /* 54.228.65.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36F10991 /* 54.241.9.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x36F23700 /* 54.242.55.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3A0650FA /* 58.6.80.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3A59560E /* 58.89.86.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3A99DD0A /* 58.153.221.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3AB7AE38 /* 58.183.174.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3B6629E1 /* 59.102.41.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3B73764C /* 59.115.118.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3B7FA39B /* 59.127.163.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3BB14343 /* 59.177.67.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3BB146D2 /* 59.177.70.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3BB311C3 /* 59.179.17.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3C362616 /* 60.54.38.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3CEA6524 /* 60.234.101.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3CF8A2B3 /* 60.248.162.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3D44D8AB /* 61.68.216.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3DE67487 /* 61.230.116.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3DE70128 /* 61.231.1.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E040F54 /* 62.4.15.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E0C736B /* 62.12.115.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E259614 /* 62.37.150.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E2D9C59 /* 62.45.156.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E2DB2A9 /* 62.45.178.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E3061B1 /* 62.48.97.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E3D8F8D /* 62.61.143.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E4852DE /* 62.72.82.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E4BFF25 /* 62.75.255.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E4C1146 /* 62.76.17.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E50C8BE /* 62.80.200.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E5ABCBC /* 62.90.188.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E669443 /* 62.102.148.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E6694A9 /* 62.102.148.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E6694AB /* 62.102.148.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E6694AC /* 62.102.148.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E6BB9CB /* 62.107.185.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E6D0473 /* 62.109.4.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E6D16C5 /* 62.109.22.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E71D3A3 /* 62.113.211.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E71D8AD /* 62.113.216.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E71D8B1 /* 62.113.216.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E71E37C /* 62.113.227.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E75AAC4 /* 62.117.170.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E858269 /* 62.133.130.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8A02B8 /* 62.138.2.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8A07AB /* 62.138.7.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8A07E7 /* 62.138.7.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8A0A3C /* 62.138.10.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8A0A3D /* 62.138.10.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8A0A3E /* 62.138.10.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8D235B /* 62.141.35.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8D2496 /* 62.141.36.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8D258E /* 62.141.37.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8D30AF /* 62.141.48.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8D34B9 /* 62.141.52.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8D3656 /* 62.141.54.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8D3775 /* 62.141.55.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8E9F55 /* 62.142.159.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E8F9ADF /* 62.143.154.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E9502BC /* 62.149.2.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E950D39 /* 62.149.13.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E982BCB /* 62.152.43.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E99066D /* 62.153.6.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3E9B9E6D /* 62.155.158.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EA62CF9 /* 62.166.44.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EA74820 /* 62.167.72.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EA803D4 /* 62.168.3.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EAD9A99 /* 62.173.154.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EB0EFE5 /* 62.176.239.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EB23FA5 /* 62.178.63.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EB278C5 /* 62.178.120.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EB28703 /* 62.178.135.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EB2F63A /* 62.178.246.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EB46D0B /* 62.180.109.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EC2ACA7 /* 62.194.172.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EC32E81 /* 62.195.46.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EC5CFB6 /* 62.197.207.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EC7AEED /* 62.199.174.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED22410 /* 62.210.36.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2242E /* 62.210.36.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED22552 /* 62.210.37.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2454F /* 62.210.69.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED245EC /* 62.210.69.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED24A6E /* 62.210.74.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED24B54 /* 62.210.75.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED24C58 /* 62.210.76.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED25134 /* 62.210.81.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2522C /* 62.210.82.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED25422 /* 62.210.84.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED25AA4 /* 62.210.90.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED25C0B /* 62.210.92.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED25D8E /* 62.210.93.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2692F /* 62.210.105.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED26974 /* 62.210.105.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED26B56 /* 62.210.107.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED26D30 /* 62.210.109.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED26D85 /* 62.210.109.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED27393 /* 62.210.115.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED27B18 /* 62.210.123.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED27B85 /* 62.210.123.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED27C7C /* 62.210.124.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED27D82 /* 62.210.125.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED281F6 /* 62.210.129.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED28438 /* 62.210.132.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED289E6 /* 62.210.137.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED28A03 /* 62.210.138.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED28C77 /* 62.210.140.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED28E27 /* 62.210.142.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2AA8F /* 62.210.170.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2BE05 /* 62.210.190.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2CE19 /* 62.210.206.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2CE35 /* 62.210.206.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2D3CE /* 62.210.211.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2D511 /* 62.210.213.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2F492 /* 62.210.244.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2F58A /* 62.210.245.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2F59E /* 62.210.245.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2F6A3 /* 62.210.246.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2F7B2 /* 62.210.247.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2FAC0 /* 62.210.250.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2FB35 /* 62.210.251.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2FE7F /* 62.210.254.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2FE84 /* 62.210.254.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED2FEC9 /* 62.210.254.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED4498D /* 62.212.73.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED6063D /* 62.214.6.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED80578 /* 62.216.5.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3ED97CFD /* 62.217.124.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EDB2E85 /* 62.219.46.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EDBB62A /* 62.219.182.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EDC9457 /* 62.220.148.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EDC9461 /* 62.220.148.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EE04740 /* 62.224.71.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EE04911 /* 62.224.73.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EE0B81D /* 62.224.184.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EEB2055 /* 62.235.32.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EF9AABA /* 62.249.170.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EFB32E8 /* 62.251.50.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3EFD8952 /* 62.253.137.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3F8DF6BA /* 63.141.246.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3F8E9DA2 /* 63.142.157.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3FDF4567 /* 63.223.69.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x3FE4435E /* 63.228.67.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x401B118C /* 64.27.17.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x404E969F /* 64.78.150.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x405B06F4 /* 64.91.6.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x405D47FD /* 64.93.71.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4071201D /* 64.113.32.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x407C2054 /* 64.124.32.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x40898B49 /* 64.137.139.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089A6E8 /* 64.137.166.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089A944 /* 64.137.169.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089AACA /* 64.137.170.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089AC79 /* 64.137.172.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089AD2B /* 64.137.173.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089AD76 /* 64.137.173.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089ADEB /* 64.137.173.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B04D /* 64.137.176.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B203 /* 64.137.178.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B22F /* 64.137.178.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B4C5 /* 64.137.180.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B698 /* 64.137.182.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B69E /* 64.137.182.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B824 /* 64.137.184.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B896 /* 64.137.184.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089B952 /* 64.137.185.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089BCF1 /* 64.137.188.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089BD4D /* 64.137.189.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089BD6D /* 64.137.189.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089BFF3 /* 64.137.191.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C3BA /* 64.137.195.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C3D6 /* 64.137.195.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C3E6 /* 64.137.195.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C5E9 /* 64.137.197.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C711 /* 64.137.199.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C860 /* 64.137.200.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C95A /* 64.137.201.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089C9B2 /* 64.137.201.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089CC42 /* 64.137.204.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089CC83 /* 64.137.204.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089CEF8 /* 64.137.206.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089D003 /* 64.137.208.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089D09F /* 64.137.208.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089D2FA /* 64.137.210.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089D454 /* 64.137.212.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089D6D8 /* 64.137.214.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089D932 /* 64.137.217.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089D9C1 /* 64.137.217.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089DAA7 /* 64.137.218.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089E09A /* 64.137.224.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089E47A /* 64.137.228.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089E5A0 /* 64.137.229.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089E64D /* 64.137.230.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089E663 /* 64.137.230.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089E738 /* 64.137.231.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089F30D /* 64.137.243.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089F343 /* 64.137.243.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089F413 /* 64.137.244.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089F460 /* 64.137.244.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089F538 /* 64.137.245.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089F768 /* 64.137.247.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089F7BF /* 64.137.247.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089FD92 /* 64.137.253.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4089FF82 /* 64.137.255.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x40BBA7E3 /* 64.187.167.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x40E5998F /* 64.229.153.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x40ED332E /* 64.237.51.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4113A782 /* 65.19.167.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4113A783 /* 65.19.167.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4113A784 /* 65.19.167.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4113A785 /* 65.19.167.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4113B2F1 /* 65.19.178.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x411BD32D /* 65.27.211.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4132CB05 /* 65.50.203.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x413C3C4E /* 65.60.60.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x416E64D6 /* 65.110.100.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x416FBA42 /* 65.111.186.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4170DD23 /* 65.112.221.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4181C419 /* 65.129.196.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x41B57BFE /* 65.181.123.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x41B792DD /* 65.183.146.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42185436 /* 66.24.84.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4237431C /* 66.55.67.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4241310F /* 66.65.49.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42554A7E /* 66.85.74.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x425A6575 /* 66.90.101.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x426EA84D /* 66.110.168.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x426F0210 /* 66.111.2.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x426F0214 /* 66.111.2.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x426F3E55 /* 66.111.62.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42746CB3 /* 66.116.108.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4294745A /* 66.148.116.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x429B04D5 /* 66.155.4.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42AA0BCB /* 66.170.11.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42AC0CFE /* 66.172.12.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42AFD94E /* 66.175.217.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42AFDD18 /* 66.175.221.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42AFDF91 /* 66.175.223.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42B4C1DB /* 66.180.193.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42BAE69A /* 66.186.230.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42BE62FE /* 66.190.98.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42D78E45 /* 66.215.142.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42D7D4B0 /* 66.215.212.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42DC03B3 /* 66.220.3.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42DFA543 /* 66.223.165.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42E42752 /* 66.228.39.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42E42753 /* 66.228.39.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42E433BA /* 66.228.51.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42E43A14 /* 66.228.58.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42EADAF7 /* 66.234.218.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42EB073E /* 66.235.7.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42F25CCB /* 66.242.92.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x42F64BA7 /* 66.246.75.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x430018B8 /* 67.0.24.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4316A2BA /* 67.22.162.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x435CADE3 /* 67.92.173.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x435CADE4 /* 67.92.173.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x435CADE5 /* 67.92.173.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43A24B3C /* 67.162.75.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43A46D15 /* 67.164.109.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43AD7728 /* 67.173.119.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43B49B15 /* 67.180.155.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43B7FAD0 /* 67.183.250.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43BA06AF /* 67.186.6.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43BC2811 /* 67.188.40.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43CD821B /* 67.205.130.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43CD92A4 /* 67.205.146.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43CDA785 /* 67.205.167.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43D7FF8C /* 67.215.255.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43E3C6B7 /* 67.227.198.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43F1491A /* 67.241.73.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43F56A30 /* 67.245.106.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43F7FF21 /* 67.247.255.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x43F98A71 /* 67.249.138.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4405E096 /* 68.5.224.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x442AC1FC /* 68.42.193.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44305597 /* 68.48.85.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44441F0E /* 68.68.31.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4445A644 /* 68.69.166.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44472E8A /* 68.71.46.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4466849E /* 68.102.132.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4468DE3A /* 68.104.222.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x446B4A1F /* 68.107.74.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x446BE751 /* 68.107.231.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x446D128D /* 68.109.18.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4481254C /* 68.129.37.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44852C65 /* 68.133.44.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4494F65B /* 68.148.246.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4497A42B /* 68.151.164.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44CE1486 /* 68.206.20.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44E0F6A9 /* 68.224.246.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44E0FCD2 /* 68.224.252.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x44E7DBD9 /* 68.231.219.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x450B0974 /* 69.11.9.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45108914 /* 69.16.137.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451C5A69 /* 69.28.90.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451EC99E /* 69.30.201.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451ECBFA /* 69.30.203.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451ED66A /* 69.30.214.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451ED6D2 /* 69.30.214.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451ED72A /* 69.30.215.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451ED7A2 /* 69.30.215.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451EDABA /* 69.30.218.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x451EFCEE /* 69.30.252.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x452731C9 /* 69.39.49.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x452F3A0C /* 69.47.58.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x452FE688 /* 69.47.230.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x453D23B8 /* 69.61.35.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x453EA2B2 /* 69.62.162.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45402E1B /* 69.64.46.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x454030A8 /* 69.64.48.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x454667CE /* 69.70.103.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45544626 /* 69.84.70.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45555CE0 /* 69.85.92.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x455A840A /* 69.90.132.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x455A840B /* 69.90.132.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x455A84B4 /* 69.90.132.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x455A84F8 /* 69.90.132.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x455A97E5 /* 69.90.151.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x455D630E /* 69.93.99.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x455D7F39 /* 69.93.127.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45739110 /* 69.115.145.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4580A9E9 /* 69.128.169.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x458AA2C2 /* 69.138.162.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x458C8C8E /* 69.140.140.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x458FBA82 /* 69.143.186.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A26B05 /* 69.162.107.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A28B09 /* 69.162.139.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A323DE /* 69.163.35.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A3640C /* 69.163.100.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4C35C /* 69.164.195.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4C524 /* 69.164.197.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4C567 /* 69.164.197.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4C620 /* 69.164.198.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4C6B5 /* 69.164.198.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4CD93 /* 69.164.205.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4CFEA /* 69.164.207.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D28C /* 69.164.210.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D28E /* 69.164.210.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D312 /* 69.164.211.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D4B4 /* 69.164.212.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D6C4 /* 69.164.214.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D6FA /* 69.164.214.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D852 /* 69.164.216.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D8E6 /* 69.164.216.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4D961 /* 69.164.217.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4DD41 /* 69.164.221.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4DD4E /* 69.164.221.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45A4DD99 /* 69.164.221.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45ACAEB5 /* 69.172.174.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45ACBA4F /* 69.172.186.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45B58A79 /* 69.181.138.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45C3929E /* 69.195.146.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45C4A529 /* 69.196.165.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45C4B929 /* 69.196.185.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45F53BF4 /* 69.245.59.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x45F5D050 /* 69.245.208.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46261F79 /* 70.38.31.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x463FAA56 /* 70.63.170.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x464FC330 /* 70.79.195.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46551FF2 /* 70.85.31.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x465C56C0 /* 70.92.86.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x465F827F /* 70.95.130.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x465FBC58 /* 70.95.188.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46705321 /* 70.112.83.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46739B5C /* 70.115.155.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46794F37 /* 70.121.79.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x467AD63B /* 70.122.214.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x467C9D6D /* 70.124.157.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46A4C5CC /* 70.164.197.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46A4FFAE /* 70.164.255.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46A92268 /* 70.169.34.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x46BBAC10 /* 70.187.172.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x470EBC03 /* 71.14.188.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x470F2597 /* 71.15.37.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x471181CA /* 71.17.129.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x471390B8 /* 71.19.144.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47139515 /* 71.19.149.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47139A8A /* 71.19.154.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47139BBB /* 71.19.155.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47139D7F /* 71.19.157.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47139DD5 /* 71.19.157.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x472EDC44 /* 71.46.220.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4738DCD9 /* 71.56.220.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x474F32B5 /* 71.79.50.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x475935A8 /* 71.89.53.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x475A52F3 /* 71.90.82.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x475B3B91 /* 71.91.59.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x475D67BC /* 71.93.103.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4787226D /* 71.135.34.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47A59723 /* 71.165.151.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47B3F68E /* 71.179.246.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47BF5FD9 /* 71.191.95.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47C7D0FA /* 71.199.208.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47CCBC94 /* 71.204.188.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47D4025A /* 71.212.2.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47E4AABA /* 71.228.170.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47E7860F /* 71.231.134.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47EED615 /* 71.238.214.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47F1FA34 /* 71.241.250.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47F8B262 /* 71.248.178.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x47FC89F6 /* 71.252.137.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x480548E3 /* 72.5.72.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x480CCF0E /* 72.12.207.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x480EB30A /* 72.14.179.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x480EB70E /* 72.14.183.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x480EB915 /* 72.14.185.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x482E9BBA /* 72.46.155.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48344B1B /* 72.52.75.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48453A52 /* 72.69.58.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48AE81B5 /* 72.174.129.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48B39262 /* 72.179.146.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48BCC700 /* 72.188.199.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48C14756 /* 72.193.71.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48C5066E /* 72.197.6.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48CC5A10 /* 72.204.90.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48DCA9A8 /* 72.220.169.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48E6EBF9 /* 72.230.235.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48EA9AA2 /* 72.234.154.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x48EE83EC /* 72.238.131.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x490403B2 /* 73.4.3.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49141AF9 /* 73.20.26.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4918243A /* 73.24.36.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x492824AA /* 73.40.36.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x492D254B /* 73.45.37.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x493C39B8 /* 73.60.57.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49425ED8 /* 73.66.94.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x494AD496 /* 73.74.212.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x494DD3B0 /* 73.77.211.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4959448A /* 73.89.68.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x495994B1 /* 73.89.148.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x495F534C /* 73.95.83.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4964011D /* 73.100.1.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49999A11 /* 73.153.154.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x499D02CC /* 73.157.2.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49A39AE2 /* 73.163.154.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49A63404 /* 73.166.52.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49AADDB8 /* 73.170.221.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49B18E1A /* 73.177.142.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49B28FEF /* 73.178.143.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49BE15CA /* 73.190.21.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49C0D90E /* 73.192.217.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49C1F239 /* 73.193.242.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49CA042A /* 73.202.4.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49CB1E92 /* 73.203.30.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49DAFBE3 /* 73.218.251.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49EA0A84 /* 73.234.10.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49EF52C1 /* 73.239.82.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x49F16918 /* 73.241.105.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A03A527 /* 74.3.165.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A323645 /* 74.50.54.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A400746 /* 74.64.7.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A41D5C0 /* 74.65.213.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A4201CA /* 74.66.1.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A43A511 /* 74.67.165.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A47EA51 /* 74.71.234.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A48CE45 /* 74.72.206.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A498F92 /* 74.73.143.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A5203E0 /* 74.82.3.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A561813 /* 74.86.24.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A5AF2A8 /* 74.90.242.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A5B1502 /* 74.91.21.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A62E668 /* 74.98.230.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A6E911C /* 74.110.145.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A74BA78 /* 74.116.186.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A79B6CE /* 74.121.182.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4A8E4A9C /* 74.142.74.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ACFE7BA /* 74.207.231.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ACFECC5 /* 74.207.236.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ACFED2C /* 74.207.237.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ACFF01A /* 74.207.240.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ACFF207 /* 74.207.242.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ACFF2F7 /* 74.207.242.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ACFF86E /* 74.207.248.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4AD04E82 /* 74.208.78.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4AD0DCDE /* 74.208.220.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B484A7B /* 75.72.74.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B57BF46 /* 75.87.191.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B77FB0E /* 75.119.251.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B7F6065 /* 75.127.96.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B869AB1 /* 75.134.154.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B877B4D /* 75.135.123.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B897058 /* 75.137.112.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B8F8310 /* 75.143.131.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4B8FBC3E /* 75.143.188.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4BA6543C /* 75.166.84.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4BA9D3F4 /* 75.169.211.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4BAF72B1 /* 75.175.114.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4BB02D57 /* 75.176.45.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4BC89768 /* 75.200.151.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C09C0CC /* 76.9.192.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C0A9D3A /* 76.10.157.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C0AA1A6 /* 76.10.161.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C0CDB68 /* 76.12.219.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C1384A3 /* 76.19.132.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C1ACBF3 /* 76.26.203.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C49EAAD /* 76.73.234.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C4DBABB /* 76.77.186.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C5462F6 /* 76.84.98.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C55C840 /* 76.85.200.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C5E7309 /* 76.94.115.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4C7AFC1B /* 76.122.252.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4CA7D7E3 /* 76.167.215.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4CFBA499 /* 76.251.164.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4CFFCE24 /* 76.255.206.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D02B2B3 /* 77.2.178.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D0C660C /* 77.12.102.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D0C81F7 /* 77.12.129.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D0C9B56 /* 77.12.155.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D0CE6EA /* 77.12.230.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D1481EC /* 77.20.129.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D14B78D /* 77.20.183.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D152983 /* 77.21.41.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D157351 /* 77.21.115.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D16C1DF /* 77.22.193.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D172632 /* 77.23.38.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D172E1C /* 77.23.46.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D17C649 /* 77.23.198.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D17F590 /* 77.23.245.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D1B8CE4 /* 77.27.140.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D2588A5 /* 77.37.136.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D258EB3 /* 77.37.142.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D259207 /* 77.37.146.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D25A012 /* 77.37.160.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D25DA91 /* 77.37.218.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D25E45A /* 77.37.228.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D25F6E3 /* 77.37.246.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D3049BD /* 77.48.73.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D3049F6 /* 77.48.73.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D38B941 /* 77.56.185.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D397E24 /* 77.57.126.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D3A4995 /* 77.58.73.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D3A94FE /* 77.58.148.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D40E649 /* 77.64.230.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D420CB9 /* 77.66.12.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D440B2A /* 77.68.11.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D44245D /* 77.68.36.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D442A84 /* 77.68.42.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D463FDC /* 77.70.63.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D494033 /* 77.73.64.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D49426F /* 77.73.66.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D4A602B /* 77.74.96.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D4BA62B /* 77.75.166.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D4FBAED /* 77.79.186.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D51687C /* 77.81.104.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D516B8A /* 77.81.107.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D51F029 /* 77.81.240.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D52EF6E /* 77.82.239.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D59DC0A /* 77.89.220.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D5F0AF2 /* 77.95.10.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D67306F /* 77.103.48.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D6CCF29 /* 77.108.207.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D6D8B57 /* 77.109.139.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D77E033 /* 77.119.224.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D77E9B6 /* 77.119.233.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D77ECD5 /* 77.119.236.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D785EE9 /* 77.120.94.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D7A4F7E /* 77.122.79.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D800EF3 /* 77.128.14.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D806BEB /* 77.128.107.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D8C5D7F /* 77.140.93.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4D8C7F44 /* 77.140.127.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DA1229D /* 77.161.34.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DAAE6A3 /* 77.170.230.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DB0E4BC /* 77.176.228.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DB31696 /* 77.179.22.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DB34110 /* 77.179.65.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DB37039 /* 77.179.112.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DB41959 /* 77.180.25.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DB55D29 /* 77.181.93.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DB6972A /* 77.182.151.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DBB53DC /* 77.187.83.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DBBB8FE /* 77.187.184.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DBC452F /* 77.188.69.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DC0D245 /* 77.192.210.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DC6638B /* 77.198.99.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DCB0D39 /* 77.203.13.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DE9EE82 /* 77.233.238.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DEC2EA4 /* 77.236.46.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DEC2EDA /* 77.236.46.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DF69DA9 /* 77.246.157.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DF6C13B /* 77.246.193.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DF7B5A3 /* 77.247.181.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DF7B5A5 /* 77.247.181.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DF96756 /* 77.249.103.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DFBEF7B /* 77.251.239.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4DFE0320 /* 77.254.3.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E08B0FE /* 78.8.176.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E15343A /* 78.21.52.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E184B35 /* 78.24.75.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E1FA429 /* 78.31.164.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2258DC /* 78.34.88.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E22BCE2 /* 78.34.188.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E242C36 /* 78.36.44.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E297391 /* 78.41.115.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2A36D3 /* 78.42.54.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E1617 /* 78.46.22.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E1E2B /* 78.46.30.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E2519 /* 78.46.37.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E251A /* 78.46.37.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E2DF2 /* 78.46.45.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E337C /* 78.46.51.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E350B /* 78.46.53.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E37E3 /* 78.46.55.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E3C1E /* 78.46.60.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E40F5 /* 78.46.64.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E434B /* 78.46.67.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E527B /* 78.46.82.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E5A17 /* 78.46.90.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E5F14 /* 78.46.95.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E70DB /* 78.46.112.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E8B99 /* 78.46.139.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E8BB6 /* 78.46.139.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E8D4A /* 78.46.141.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E913A /* 78.46.145.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2E970B /* 78.46.151.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EA233 /* 78.46.162.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EA27B /* 78.46.162.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EA2F6 /* 78.46.162.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EB97C /* 78.46.185.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EBD98 /* 78.46.189.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EBDC3 /* 78.46.189.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EC129 /* 78.46.193.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EC21F /* 78.46.194.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EC7B7 /* 78.46.199.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2ECB12 /* 78.46.203.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2ED170 /* 78.46.209.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2ED426 /* 78.46.212.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EDC82 /* 78.46.220.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EDD30 /* 78.46.221.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EDF86 /* 78.46.223.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EE12E /* 78.46.225.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EEFB7 /* 78.46.239.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EF61C /* 78.46.246.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EF724 /* 78.46.247.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2EF947 /* 78.46.249.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F0915 /* 78.47.9.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F126E /* 78.47.18.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F1D44 /* 78.47.29.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F2323 /* 78.47.35.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F273C /* 78.47.39.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F3D5E /* 78.47.61.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F3D81 /* 78.47.61.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F3DDE /* 78.47.61.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F405B /* 78.47.64.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F4093 /* 78.47.64.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F467B /* 78.47.70.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F5462 /* 78.47.84.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F56D2 /* 78.47.86.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F5D16 /* 78.47.93.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F659D /* 78.47.101.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F86C3 /* 78.47.134.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F86C4 /* 78.47.134.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F883E /* 78.47.136.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2F8ED3 /* 78.47.142.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FA743 /* 78.47.167.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FAE9B /* 78.47.174.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FB04A /* 78.47.176.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FDABE /* 78.47.218.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FDD47 /* 78.47.221.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FE0DB /* 78.47.224.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FE0DE /* 78.47.224.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FE101 /* 78.47.225.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FE56B /* 78.47.229.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FEF50 /* 78.47.239.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E2FF9E2 /* 78.47.249.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E303064 /* 78.48.48.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E33FF42 /* 78.51.255.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E354732 /* 78.53.71.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E361CA0 /* 78.54.28.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E371126 /* 78.55.17.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E37D9C6 /* 78.55.217.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E382816 /* 78.56.40.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E387C10 /* 78.56.124.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E3A9597 /* 78.58.149.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E44EA63 /* 78.68.234.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E460AE6 /* 78.70.10.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E4993FD /* 78.73.147.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E5347A6 /* 78.83.71.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E54FD7A /* 78.84.253.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E5859F2 /* 78.88.89.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E5A0FE5 /* 78.90.15.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E5AE3E4 /* 78.90.227.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E5E456A /* 78.94.69.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E5E4AEC /* 78.94.74.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E5E5CAA /* 78.94.92.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E660C17 /* 78.102.12.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6AF999 /* 78.106.249.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6BED10 /* 78.107.237.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6BEFD5 /* 78.107.239.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6C2E72 /* 78.108.46.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6C2E82 /* 78.108.46.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6C2E83 /* 78.108.46.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6C426E /* 78.108.66.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E6C4D56 /* 78.108.77.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E7502F4 /* 78.117.2.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E783339 /* 78.120.51.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E7C9F3B /* 78.124.159.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E7DFAE3 /* 78.125.250.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E81891C /* 78.129.137.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E81ED55 /* 78.129.237.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E82806A /* 78.130.128.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E82C387 /* 78.130.195.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E833886 /* 78.131.56.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E8E130B /* 78.142.19.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E8E13D7 /* 78.142.19.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E8E13E2 /* 78.142.19.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E8E8EF6 /* 78.142.142.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E8E918D /* 78.142.145.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E8EAF46 /* 78.142.175.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E9515EA /* 78.149.21.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E9C6E87 /* 78.156.110.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4E9C75EC /* 78.156.117.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC07C94 /* 78.192.124.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC128CD /* 78.193.40.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC18C04 /* 78.193.140.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC1DA61 /* 78.193.218.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC2251D /* 78.194.37.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC2984B /* 78.194.152.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC2DC36 /* 78.194.220.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC6B4CD /* 78.198.180.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC827AF /* 78.200.39.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EC89C77 /* 78.200.156.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4ED59256 /* 78.213.146.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EDDDF3A /* 78.221.223.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EDF9B68 /* 78.223.155.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EE722BC /* 78.231.34.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EE8E1A3 /* 78.232.225.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EE96597 /* 78.233.101.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4EF8D759 /* 78.248.215.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F286537 /* 79.40.101.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F358078 /* 79.53.128.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F386648 /* 79.56.102.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F442316 /* 79.68.35.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F626912 /* 79.98.105.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F626C39 /* 79.98.108.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F626D30 /* 79.98.109.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F6FAB73 /* 79.111.171.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F703775 /* 79.112.55.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F73D242 /* 79.115.210.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F780A62 /* 79.120.10.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F782993 /* 79.120.41.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F7851B7 /* 79.120.81.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F785566 /* 79.120.85.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F7C070B /* 79.124.7.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F7C152D /* 79.124.21.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F7C3BC2 /* 79.124.59.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F7C3C84 /* 79.124.60.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F84E8B3 /* 79.132.232.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F85D20B /* 79.133.210.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F86EAF7 /* 79.134.234.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F86FFC8 /* 79.134.255.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F88014A /* 79.136.1.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F881D2B /* 79.136.29.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F88465D /* 79.136.70.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F88467D /* 79.136.70.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F889972 /* 79.136.153.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F892169 /* 79.137.33.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F892183 /* 79.137.33.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F892395 /* 79.137.35.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F892727 /* 79.137.39.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F894E65 /* 79.137.78.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F894F1F /* 79.137.79.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F895042 /* 79.137.80.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8951A8 /* 79.137.81.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F895547 /* 79.137.85.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8957D4 /* 79.137.87.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8957D5 /* 79.137.87.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F896A9A /* 79.137.106.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F897004 /* 79.137.112.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F897005 /* 79.137.112.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F89742B /* 79.137.116.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8C290D /* 79.140.41.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8C2975 /* 79.140.41.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8C2976 /* 79.140.41.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8FB287 /* 79.143.178.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8FB72C /* 79.143.183.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F8FBA11 /* 79.143.186.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4F9ADC72 /* 79.154.220.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FA1F802 /* 79.161.248.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FA53834 /* 79.165.56.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FA5B4F3 /* 79.165.180.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FA9225F /* 79.169.34.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FAC1212 /* 79.172.18.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FAC1CCD /* 79.172.28.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FACC120 /* 79.172.193.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FACCC24 /* 79.172.204.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FB07031 /* 79.176.112.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FB1769C /* 79.177.118.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FC1CF94 /* 79.193.207.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FC4F70C /* 79.196.247.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FC56DEA /* 79.197.109.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FC5CD8D /* 79.197.205.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FC6AE73 /* 79.198.174.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FCB5108 /* 79.203.81.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FCC8FCE /* 79.204.143.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FCC931C /* 79.204.147.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FCD1428 /* 79.205.20.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FCDE527 /* 79.205.229.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FCFE3CA /* 79.207.227.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FD04520 /* 79.208.69.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FD26917 /* 79.210.105.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FD3FCD9 /* 79.211.252.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FD44F49 /* 79.212.79.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FD6F2FD /* 79.214.242.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FD99C2A /* 79.217.156.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FDA50AA /* 79.218.80.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FDEC135 /* 79.222.193.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FDEF68C /* 79.222.246.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE0586C /* 79.224.88.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE1D1EA /* 79.225.209.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE3834A /* 79.227.131.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE3DEAF /* 79.227.222.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE5C065 /* 79.229.192.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE75712 /* 79.231.87.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE77B42 /* 79.231.123.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE7E4AA /* 79.231.228.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE96869 /* 79.233.104.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE9BD96 /* 79.233.189.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FE9D01A /* 79.233.208.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FEAB928 /* 79.234.185.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FEE3FEE /* 79.238.63.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FEFCB56 /* 79.239.203.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FEFF6BC /* 79.239.246.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF0E1D2 /* 79.240.225.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF1C20A /* 79.241.194.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF1CEA5 /* 79.241.206.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF1F58B /* 79.241.245.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF34FCE /* 79.243.79.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF7728E /* 79.247.114.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF78368 /* 79.247.131.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x4FF89FC8 /* 79.248.159.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x500736BB /* 80.7.54.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x500C5EB8 /* 80.12.94.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x500F627F /* 80.15.98.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x501ACE0B /* 80.26.206.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x501F4713 /* 80.31.71.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x501FF2DA /* 80.31.242.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x503CF5EA /* 80.60.245.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50404119 /* 80.64.65.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5042877B /* 80.66.135.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5043ACA2 /* 80.67.172.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50445CF9 /* 80.68.92.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50478339 /* 80.71.131.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50478577 /* 80.71.133.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50478C09 /* 80.71.140.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5049F28E /* 80.73.242.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x504F1707 /* 80.79.23.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50510C1D /* 80.81.12.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5051111F /* 80.81.17.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5051F378 /* 80.81.243.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5051F3EB /* 80.81.243.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x505242E9 /* 80.82.66.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50555417 /* 80.85.84.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50555448 /* 80.85.84.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x505554DE /* 80.85.84.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x505AFA45 /* 80.90.250.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5062B2B4 /* 80.98.178.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506300DF /* 80.99.0.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50634673 /* 80.99.70.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5063A98E /* 80.99.169.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50640799 /* 80.100.7.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50649D29 /* 80.100.157.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5064FAF4 /* 80.100.250.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506589DF /* 80.101.137.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506C120B /* 80.108.18.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506C1DAF /* 80.108.29.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506C8F13 /* 80.108.143.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506CC3FA /* 80.108.195.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506DD102 /* 80.109.209.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x506DF964 /* 80.109.249.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5072219A /* 80.114.33.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5074C31C /* 80.116.195.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50778941 /* 80.119.137.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507A5A2E /* 80.122.90.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F6B9A /* 80.127.107.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F6BB3 /* 80.127.107.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F6D32 /* 80.127.109.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F75B4 /* 80.127.117.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F765D /* 80.127.118.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F80BE /* 80.127.128.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F8913 /* 80.127.137.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F8F5A /* 80.127.143.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x507F97A2 /* 80.127.151.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5083F110 /* 80.131.241.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x508649F1 /* 80.134.73.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50887E89 /* 80.136.126.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5088A7B2 /* 80.136.167.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50895F35 /* 80.137.95.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x508C60BE /* 80.140.96.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x508DE120 /* 80.141.225.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5090E36A /* 80.144.227.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5091EE43 /* 80.145.238.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5093219D /* 80.147.33.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5093BE2F /* 80.147.190.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50990704 /* 80.153.7.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5099125B /* 80.153.18.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5099F1A9 /* 80.153.241.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50A22B48 /* 80.162.43.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50A9F14C /* 80.169.241.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50C2115C /* 80.194.17.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50CB8917 /* 80.203.137.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50DA541C /* 80.218.84.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50DABABF /* 80.218.186.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50DB0012 /* 80.219.0.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50DC141F /* 80.220.20.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50DC5AA8 /* 80.220.90.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50DCEA3F /* 80.220.234.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50E58CEF /* 80.229.140.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50E598E4 /* 80.229.152.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50E8CDD6 /* 80.232.205.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50E8F21F /* 80.232.242.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50E98632 /* 80.233.134.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50E98695 /* 80.233.134.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50EC3338 /* 80.236.51.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50EDE786 /* 80.237.231.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50EE7A6A /* 80.238.122.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F086F6 /* 80.240.134.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F08B6F /* 80.240.139.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F0D8FD /* 80.240.216.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F13CCF /* 80.241.60.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F1DCDD /* 80.241.220.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F368B6 /* 80.243.104.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F451BF /* 80.244.81.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F4F1FE /* 80.244.241.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F4F39E /* 80.244.243.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F8D083 /* 80.248.208.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50F8F02B /* 80.248.240.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50FEDB30 /* 80.254.219.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50FF060B /* 80.255.6.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x50FF0BC4 /* 80.255.11.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51003B92 /* 81.0.59.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5100E203 /* 81.0.226.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5102C521 /* 81.2.197.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5102D10A /* 81.2.209.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5102EDDA /* 81.2.237.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5102F777 /* 81.2.247.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5102F7A5 /* 81.2.247.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5104655D /* 81.4.101.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x510467AA /* 81.4.103.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51046CC7 /* 81.4.108.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51046D2F /* 81.4.109.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51046DD0 /* 81.4.109.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51046E95 /* 81.4.110.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51047930 /* 81.4.121.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51047D0D /* 81.4.125.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5107038D /* 81.7.3.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x510703F7 /* 81.7.3.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070A14 /* 81.7.10.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070A1D /* 81.7.10.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070A44 /* 81.7.10.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070A5D /* 81.7.10.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070AFB /* 81.7.10.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070B16 /* 81.7.11.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070B46 /* 81.7.11.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070B8E /* 81.7.11.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070B9A /* 81.7.11.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070BFD /* 81.7.11.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070D54 /* 81.7.13.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070DF8 /* 81.7.13.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070E19 /* 81.7.14.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51070EE3 /* 81.7.14.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5107101F /* 81.7.16.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5107103B /* 81.7.16.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5107108B /* 81.7.16.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x510710B1 /* 81.7.16.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x510710B6 /* 81.7.16.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51071254 /* 81.7.18.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x510A8C06 /* 81.10.140.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x510A9F12 /* 81.10.159.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5111102B /* 81.17.16.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51111182 /* 81.17.17.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51111183 /* 81.17.17.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51111E21 /* 81.17.30.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51111E2C /* 81.17.30.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51111E30 /* 81.17.30.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51130347 /* 81.19.3.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5116FF92 /* 81.22.255.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x511738FF /* 81.23.56.255/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51193683 /* 81.25.54.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x511E9E51 /* 81.30.158.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x511E9E90 /* 81.30.158.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x511E9ED5 /* 81.30.158.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x511E9EDF /* 81.30.158.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51218578 /* 81.33.133.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5125E02A /* 81.37.224.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5138C0E7 /* 81.56.192.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5139D087 /* 81.57.208.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5142884E /* 81.66.136.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5142CC1C /* 81.66.204.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900C3 /* 81.89.0.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900C4 /* 81.89.0.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900C5 /* 81.89.0.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900C6 /* 81.89.0.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900C7 /* 81.89.0.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900C8 /* 81.89.0.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900C9 /* 81.89.0.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900CA /* 81.89.0.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900CB /* 81.89.0.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515900CC /* 81.89.0.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51593F96 /* 81.89.63.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515F0D37 /* 81.95.13.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x515F3444 /* 81.95.52.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51618FF7 /* 81.97.143.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51672409 /* 81.103.36.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5184FFEF /* 81.132.255.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x518DE01A /* 81.141.224.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5195968F /* 81.149.150.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5199E91D /* 81.153.233.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x519B2F59 /* 81.155.47.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x519F452C /* 81.159.69.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A46265 /* 81.164.98.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A982D6 /* 81.169.130.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A988CE /* 81.169.136.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A98A33 /* 81.169.138.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A98DDE /* 81.169.141.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A99864 /* 81.169.152.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A9A64A /* 81.169.166.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A9AFA4 /* 81.169.175.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A9B55F /* 81.169.181.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A9B9E9 /* 81.169.185.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A9DE9E /* 81.169.222.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51A9F6CC /* 81.169.246.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AA841C /* 81.170.132.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AA94C2 /* 81.170.148.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AD9793 /* 81.173.151.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AE962B /* 81.174.150.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AE97D7 /* 81.174.151.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AE9B2F /* 81.174.155.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AEE712 /* 81.174.231.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AFDB02 /* 81.175.219.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51AFDDCF /* 81.175.221.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51B77151 /* 81.183.113.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51BE6077 /* 81.190.96.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51C14B5B /* 81.193.75.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51D9121D /* 81.217.18.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51D920C1 /* 81.217.32.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51D9BB06 /* 81.217.187.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51DA5B9A /* 81.218.91.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51DA6DC3 /* 81.218.109.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51DA8A03 /* 81.218.138.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51DD947F /* 81.221.148.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51E3D84C /* 81.227.216.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51E4C09D /* 81.228.192.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51E4C74B /* 81.228.199.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51E66CC0 /* 81.230.108.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51E6A691 /* 81.230.166.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51E81EC2 /* 81.232.30.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51ECAF80 /* 81.236.175.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51F34BD0 /* 81.243.75.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51F52A42 /* 81.245.42.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51F5E6FD /* 81.245.230.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x51FEAF31 /* 81.254.175.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52018046 /* 82.1.128.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52052A69 /* 82.5.42.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x520BAC32 /* 82.11.172.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5215D31D /* 82.21.211.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x521B7682 /* 82.27.118.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x521CE407 /* 82.28.228.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52290A87 /* 82.41.10.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x522CCB7C /* 82.44.203.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5231CF20 /* 82.49.207.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52433720 /* 82.67.55.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52449FD9 /* 82.68.159.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52454C23 /* 82.69.76.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5247D30D /* 82.71.211.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5247F64F /* 82.71.246.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x524CB63D /* 82.76.182.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52502163 /* 82.80.33.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52503640 /* 82.80.54.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5252BED7 /* 82.82.190.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x525ECCAA /* 82.94.204.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x525EE292 /* 82.94.226.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x525EFBE3 /* 82.94.251.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x525F42CB /* 82.95.66.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x525F6B33 /* 82.95.107.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52668ED2 /* 82.102.142.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52678C57 /* 82.103.140.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5273740B /* 82.115.116.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52747803 /* 82.116.120.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5276F20E /* 82.118.242.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5276F215 /* 82.118.242.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5276F27F /* 82.118.242.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5276F280 /* 82.118.242.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5276F293 /* 82.118.242.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5277E924 /* 82.119.233.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5282090F /* 82.130.9.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52820B94 /* 82.130.11.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52820D9A /* 82.130.13.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52834A12 /* 82.131.74.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x528B60C9 /* 82.139.96.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x529225CC /* 82.146.37.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52922F11 /* 82.146.47.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x529237CD /* 82.146.55.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5295F13D /* 82.149.241.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x529B43BE /* 82.155.67.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x529EA2AB /* 82.158.162.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A1321E /* 82.161.50.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A1B614 /* 82.161.182.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A1D257 /* 82.161.210.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A1D4D1 /* 82.161.212.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A58E4F /* 82.165.142.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A594A3 /* 82.165.148.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A5CF66 /* 82.165.207.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52A80E92 /* 82.168.14.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52B301A2 /* 82.179.1.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52B574C7 /* 82.181.116.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52B5D46A /* 82.181.212.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52B5E7C4 /* 82.181.231.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52B5EE90 /* 82.181.238.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C2AA1E /* 82.194.170.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C406C7 /* 82.196.6.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C4080D /* 82.196.8.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C408E8 /* 82.196.8.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C40E8E /* 82.196.14.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C46AA0 /* 82.196.106.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C47CC2 /* 82.196.124.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52C79B59 /* 82.199.155.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52CFED13 /* 82.207.237.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D1B3A3 /* 82.209.179.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D300B4 /* 82.211.0.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D300C9 /* 82.211.0.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D3138F /* 82.211.19.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D31FF7 /* 82.211.31.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D40E20 /* 82.212.14.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D5DEEA /* 82.213.222.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52D9D6D7 /* 82.217.214.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DB0959 /* 82.219.9.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DC5935 /* 82.220.89.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DD6543 /* 82.221.101.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DD69C6 /* 82.221.105.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DD8014 /* 82.221.128.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DD80D9 /* 82.221.128.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DD8B19 /* 82.221.139.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DD8BBE /* 82.221.139.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52DF154A /* 82.223.21.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E092B3 /* 82.224.146.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E2473B /* 82.226.71.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E28C77 /* 82.226.140.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E4FC14 /* 82.228.252.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E51AEB /* 82.229.26.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E58A1F /* 82.229.138.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E58A8F /* 82.229.138.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52E97597 /* 82.233.117.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52EE55F0 /* 82.238.85.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52EF01CD /* 82.239.1.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52F25792 /* 82.242.87.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52F298D3 /* 82.242.152.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52F385B4 /* 82.243.133.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52F4B127 /* 82.244.177.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52F7C6E3 /* 82.247.198.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52FA03EC /* 82.250.3.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52FB1146 /* 82.251.17.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x52FB2188 /* 82.251.33.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5321BD8F /* 83.33.189.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53240901 /* 83.36.9.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x532CCF03 /* 83.44.207.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x533776BF /* 83.55.118.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x533FF441 /* 83.63.244.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5345F255 /* 83.69.242.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x534D9DFE /* 83.77.157.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53528CF1 /* 83.82.140.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5352EA6A /* 83.82.234.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5353FB49 /* 83.83.251.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x535573E3 /* 83.85.115.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5355FC37 /* 83.85.252.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53567804 /* 83.86.120.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x535969A0 /* 83.89.105.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53802930 /* 83.128.41.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x538632D0 /* 83.134.50.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5386E05A /* 83.134.224.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53885104 /* 83.136.81.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x538FF556 /* 83.143.245.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5391F1E7 /* 83.145.241.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5392F130 /* 83.146.241.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53951426 /* 83.149.20.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53960BCB /* 83.150.11.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x539613F3 /* 83.150.19.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5396527A /* 83.150.82.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x539A832B /* 83.154.131.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A08BB7 /* 83.160.139.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A1DAE2 /* 83.161.218.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A22F1A /* 83.162.47.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A2B243 /* 83.162.178.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A2BC64 /* 83.162.188.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A2C73C /* 83.162.199.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A2CAB6 /* 83.162.202.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A2CD44 /* 83.162.205.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A34DC3 /* 83.163.77.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A3C9A8 /* 83.163.201.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A7B923 /* 83.167.185.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A8C8CC /* 83.168.200.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53A9060C /* 83.169.6.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53ABA70D /* 83.171.167.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53AF6482 /* 83.175.100.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53CDEECD /* 83.205.238.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D45257 /* 83.212.82.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D45296 /* 83.212.82.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D460B7 /* 83.212.96.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D460CE /* 83.212.96.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D46344 /* 83.212.99.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D463D4 /* 83.212.99.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D46464 /* 83.212.100.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D46612 /* 83.212.102.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D46672 /* 83.212.102.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D4687C /* 83.212.104.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D46891 /* 83.212.104.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D46990 /* 83.212.105.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D473E0 /* 83.212.115.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D47661 /* 83.212.118.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53D4A8BA /* 83.212.168.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53DCB3AF /* 83.220.179.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53E336EA /* 83.227.54.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53E45D4C /* 83.228.93.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53E71225 /* 83.231.18.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53E94C6F /* 83.233.76.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53F065D1 /* 83.240.101.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53F74E5A /* 83.247.78.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53F82268 /* 83.248.34.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53F85AD3 /* 83.248.90.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53F8A8D8 /* 83.248.168.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FB4937 /* 83.251.73.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FC534F /* 83.252.83.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FD0764 /* 83.253.7.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FD3E77 /* 83.253.62.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FD8858 /* 83.253.136.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FE5D4E /* 83.254.93.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FECFC5 /* 83.254.207.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x53FF6C65 /* 83.255.108.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54030035 /* 84.3.0.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413B24F /* 84.19.178.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413B269 /* 84.19.178.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413B29B /* 84.19.178.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413B36A /* 84.19.179.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413B3E5 /* 84.19.179.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413B487 /* 84.19.180.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413B881 /* 84.19.184.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413BDF2 /* 84.19.189.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5413BE9D /* 84.19.190.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x541B5F35 /* 84.27.95.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x542862BB /* 84.40.98.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54287046 /* 84.40.112.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x542E1498 /* 84.46.20.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x542E1E4A /* 84.46.30.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x542E1EF5 /* 84.46.30.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5430C74E /* 84.48.199.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5435F7A9 /* 84.53.247.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5437525E /* 84.55.82.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54382D7B /* 84.56.45.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54398A2E /* 84.57.138.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x543C2DE8 /* 84.60.45.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x543D3004 /* 84.61.48.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x543D5E07 /* 84.61.94.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x543F40DB /* 84.63.64.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54482813 /* 84.72.40.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54490F5C /* 84.73.15.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54491458 /* 84.73.20.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5449149D /* 84.73.20.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5449244A /* 84.73.36.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5449DC41 /* 84.73.220.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x544A50D2 /* 84.74.80.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x544B19CA /* 84.75.25.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x544B44EB /* 84.75.68.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x544BC8E5 /* 84.75.200.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x544BE77C /* 84.75.231.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54505045 /* 84.80.80.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x545C6161 /* 84.92.97.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5468BF39 /* 84.104.191.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x546AEA98 /* 84.106.234.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x546B6E0C /* 84.107.110.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54702924 /* 84.112.41.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54720336 /* 84.114.3.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5472B966 /* 84.114.185.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x547323F8 /* 84.115.35.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5476AF83 /* 84.118.175.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54774190 /* 84.119.65.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5482A597 /* 84.130.165.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5484E3F1 /* 84.132.227.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54865441 /* 84.134.84.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x548945CA /* 84.137.69.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x548D7630 /* 84.141.118.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x548FD821 /* 84.143.216.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x548FDE8F /* 84.143.222.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54904522 /* 84.144.69.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549073D9 /* 84.144.115.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5490E8AC /* 84.144.232.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5492A167 /* 84.146.161.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549665CA /* 84.150.101.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549675DA /* 84.150.117.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549A7446 /* 84.154.116.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549ABD38 /* 84.154.189.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549C028A /* 84.156.2.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549CBC46 /* 84.156.188.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549EC45B /* 84.158.196.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549F49CE /* 84.159.73.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x549F4C3F /* 84.159.76.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54A09ACC /* 84.160.154.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54A21CE2 /* 84.162.28.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54A5409F /* 84.165.64.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54A8F9D7 /* 84.168.249.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54AB51E6 /* 84.171.81.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54AB5BC7 /* 84.171.91.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54ADDF9F /* 84.173.223.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54AE63C4 /* 84.174.99.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54B0EA0E /* 84.176.234.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54B0FB8A /* 84.176.251.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54B166C5 /* 84.177.102.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54B4603C /* 84.180.96.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54B6A117 /* 84.182.161.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54B6BFDF /* 84.182.191.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54B7EEC3 /* 84.183.238.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54BA3653 /* 84.186.54.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54BB8B4A /* 84.187.139.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54BCA06A /* 84.188.160.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54BF23C8 /* 84.191.35.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54BFF098 /* 84.191.240.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C10029 /* 84.193.0.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C3E5B6 /* 84.195.229.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C80821 /* 84.200.8.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C808CF /* 84.200.8.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C80ECE /* 84.200.14.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C83212 /* 84.200.50.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C83822 /* 84.200.56.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C83824 /* 84.200.56.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C84DF3 /* 84.200.77.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C852A3 /* 84.200.82.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54C8CE63 /* 84.200.206.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54CA5A7A /* 84.202.90.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54CA74A4 /* 84.202.116.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54D11ABA /* 84.209.26.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54D6DC87 /* 84.214.220.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54D7A360 /* 84.215.163.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54D8E951 /* 84.216.233.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54D8FCC8 /* 84.216.252.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54DBF8F9 /* 84.219.248.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54E20D1B /* 84.226.13.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54E27D07 /* 84.226.125.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54E3DA07 /* 84.227.218.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54E61807 /* 84.230.24.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54EC35E6 /* 84.236.53.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54ED96AB /* 84.237.150.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F03CEA /* 84.240.60.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F14114 /* 84.241.65.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F41F34 /* 84.244.31.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F50FFD /* 84.245.15.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F51940 /* 84.245.25.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F51BD1 /* 84.245.27.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F51E9A /* 84.245.30.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F848E7 /* 84.248.72.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F900C1 /* 84.249.0.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F910D7 /* 84.249.16.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54F9C7E6 /* 84.249.199.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54FA1259 /* 84.250.18.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54FA720A /* 84.250.114.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x54FB54F3 /* 84.251.84.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55002B59 /* 85.0.43.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55004029 /* 85.0.64.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55047E83 /* 85.4.126.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5507B414 /* 85.7.180.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550A6A2F /* 85.10.106.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550AC409 /* 85.10.196.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550AC40C /* 85.10.196.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550AC6EC /* 85.10.198.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550AC92F /* 85.10.201.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550ACA57 /* 85.10.202.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550ACB47 /* 85.10.203.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550ACBAB /* 85.10.203.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550AF0FA /* 85.10.240.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550EF337 /* 85.14.243.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x550EF9F7 /* 85.14.249.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5510AA7D /* 85.16.170.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55111A05 /* 85.17.26.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55117020 /* 85.17.112.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x551170A3 /* 85.17.112.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5511A4A5 /* 85.17.164.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5511A4AC /* 85.17.164.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5511AC4B /* 85.17.172.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5511C2B4 /* 85.17.194.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5511D6B1 /* 85.17.214.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x551590E0 /* 85.21.144.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55189139 /* 85.24.145.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5518A288 /* 85.24.162.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5518B4C8 /* 85.24.180.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55192C8D /* 85.25.44.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55196745 /* 85.25.103.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55198405 /* 85.25.132.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55198522 /* 85.25.133.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x551995A1 /* 85.25.149.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x551996D8 /* 85.25.150.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55199F41 /* 85.25.159.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55199FFD /* 85.25.159.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5519D5D3 /* 85.25.213.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5519F86C /* 85.25.248.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5519FF8C /* 85.25.255.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x551FBAA4 /* 85.31.186.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x551FBAFD /* 85.31.186.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55305EAE /* 85.48.94.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5556DA1B /* 85.86.218.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x555AF417 /* 85.90.244.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x555AF61E /* 85.90.246.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x555D102F /* 85.93.16.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x555D118F /* 85.93.17.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x555DD12C /* 85.93.209.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x555DD914 /* 85.93.217.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x555DDACC /* 85.93.218.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5571279A /* 85.113.39.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55728560 /* 85.114.133.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55775297 /* 85.119.82.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5577538D /* 85.119.83.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x557F54E9 /* 85.127.84.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x558398DD /* 85.131.152.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x558CB60C /* 85.140.182.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x558FD2E9 /* 85.143.210.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x558FDBD3 /* 85.143.219.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55902C37 /* 85.144.44.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5591AD1F /* 85.145.173.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5598E41D /* 85.152.228.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x559D7EA2 /* 85.157.126.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x559FD337 /* 85.159.211.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x559FEDD2 /* 85.159.237.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55A53635 /* 85.165.54.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55A71195 /* 85.167.17.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55ABADA1 /* 85.171.173.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55B584A4 /* 85.181.132.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55B8A080 /* 85.184.160.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55BEFF04 /* 85.190.255.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55BFF855 /* 85.191.248.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C36BFA /* 85.195.107.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C3CF6F /* 85.195.207.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C3D709 /* 85.195.215.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C3EB78 /* 85.195.235.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C3F28A /* 85.195.242.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C3F2E2 /* 85.195.242.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C3FC68 /* 85.195.252.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55C3FCC6 /* 85.195.252.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D4009E /* 85.212.0.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D406BD /* 85.212.6.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D42363 /* 85.212.35.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D42B74 /* 85.212.43.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D42DB8 /* 85.212.45.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D4395F /* 85.212.57.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D617BC /* 85.214.23.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D62CAC /* 85.214.44.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D636FE /* 85.214.54.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D63AEC /* 85.214.58.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D63E30 /* 85.214.62.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6407E /* 85.214.64.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D642BB /* 85.214.66.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6454B /* 85.214.69.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D665E9 /* 85.214.101.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D66C5F /* 85.214.108.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D673D6 /* 85.214.115.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D67CA8 /* 85.214.124.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D67D0B /* 85.214.125.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D680A0 /* 85.214.128.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D680C7 /* 85.214.128.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6907F /* 85.214.144.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6909F /* 85.214.144.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D69748 /* 85.214.151.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6CEDB /* 85.214.206.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6E5B0 /* 85.214.229.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6ECCF /* 85.214.236.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D6F40D /* 85.214.244.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D809FE /* 85.216.9.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55D85A76 /* 85.216.90.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55DC2AC3 /* 85.220.42.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55DCBEF6 /* 85.220.190.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55DE00E5 /* 85.222.0.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E2753E /* 85.226.117.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E279EB /* 85.226.121.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E3814C /* 85.227.129.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E3BABD /* 85.227.186.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E3BC91 /* 85.227.188.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E3BCCD /* 85.227.188.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E44587 /* 85.228.69.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E55450 /* 85.229.84.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E55FF1 /* 85.229.95.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E5E4AE /* 85.229.228.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E61558 /* 85.230.21.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E6887E /* 85.230.136.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55E6EF64 /* 85.230.239.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55EBFA58 /* 85.235.250.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55F09F14 /* 85.240.159.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55F0FFE6 /* 85.240.255.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55F23B3B /* 85.242.59.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55F567DE /* 85.245.103.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55F8E3A3 /* 85.248.227.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55F8E3A4 /* 85.248.227.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55F8E3A5 /* 85.248.227.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55FF019E /* 85.255.1.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x55FF0863 /* 85.255.8.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56037EC1 /* 86.3.126.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56078C1F /* 86.7.140.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x561277B3 /* 86.18.119.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x561704E0 /* 86.23.4.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5619641D /* 86.25.100.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x561DD073 /* 86.29.208.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x563864B9 /* 86.56.100.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x563B1526 /* 86.59.21.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x563B15A3 /* 86.59.21.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x563B7753 /* 86.59.119.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x563B7758 /* 86.59.119.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x563BA563 /* 86.59.165.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5646384E /* 86.70.56.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x564C4BF0 /* 86.76.75.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5653791D /* 86.83.121.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56537ACB /* 86.83.122.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5656AD3E /* 86.86.173.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x565820C7 /* 86.88.32.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56582191 /* 86.88.33.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56657F7A /* 86.101.127.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5667BC2F /* 86.103.188.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56680F0F /* 86.104.15.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5669D482 /* 86.105.212.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5669D4CC /* 86.105.212.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x566A8906 /* 86.106.137.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x566B6E22 /* 86.107.110.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x566B6E52 /* 86.107.110.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x566B6E8F /* 86.107.110.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x566B6EE0 /* 86.107.110.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x566E7549 /* 86.110.117.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x566E7595 /* 86.110.117.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x567BDFAE /* 86.123.223.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x567DE7E3 /* 86.125.231.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56805BEF /* 86.128.91.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5687B16A /* 86.135.177.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x568EFA19 /* 86.142.250.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5699F453 /* 86.153.244.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x569BDBB7 /* 86.155.219.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56AC5B6A /* 86.172.91.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56AE499A /* 86.174.73.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56B3C248 /* 86.179.194.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56CA8ED2 /* 86.202.142.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56CAE27C /* 86.202.226.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56E53486 /* 86.229.52.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56EE99B7 /* 86.238.153.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56EEDDD9 /* 86.238.221.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56F56FEC /* 86.245.111.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56F6018B /* 86.246.1.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56F6AC32 /* 86.246.172.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x56FD45C5 /* 86.253.69.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5702EC23 /* 87.2.236.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57056E71 /* 87.5.110.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57071528 /* 87.7.21.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5714C5DD /* 87.20.197.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57340321 /* 87.52.3.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x573CAC5C /* 87.60.172.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x574849E7 /* 87.72.73.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5748C571 /* 87.72.197.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5748EFBB /* 87.72.239.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5749544D /* 87.73.84.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x574F2E08 /* 87.79.46.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x574F4F5E /* 87.79.79.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x574F5F97 /* 87.79.95.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x574FFDCA /* 87.79.253.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5751943D /* 87.81.148.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x575C111C /* 87.92.17.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x575C61C2 /* 87.92.97.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x575CA318 /* 87.92.163.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57629897 /* 87.98.152.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5762B23D /* 87.98.178.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5762B905 /* 87.98.185.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5762F396 /* 87.98.243.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5762F554 /* 87.98.245.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5762FAF4 /* 87.98.250.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5762FD54 /* 87.98.253.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57660FD8 /* 87.102.15.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x576A0E9F /* 87.106.14.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x576A3B0C /* 87.106.59.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x576A8C18 /* 87.106.140.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x576AD0EC /* 87.106.208.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x576AF976 /* 87.106.249.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x577654B5 /* 87.118.84.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57765C2B /* 87.118.92.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57765EE3 /* 87.118.94.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57766436 /* 87.118.100.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57766A40 /* 87.118.106.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57766E71 /* 87.118.110.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57766E9E /* 87.118.110.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5776703F /* 87.118.112.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767286 /* 87.118.114.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767291 /* 87.118.114.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x577673B0 /* 87.118.115.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5776740C /* 87.118.116.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5776745A /* 87.118.116.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x577674E3 /* 87.118.116.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767A1E /* 87.118.122.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767A32 /* 87.118.122.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767A33 /* 87.118.122.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767AC9 /* 87.118.122.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767AFE /* 87.118.122.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767ECE /* 87.118.126.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57767EDA /* 87.118.126.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5778241A /* 87.120.36.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5778FE47 /* 87.120.254.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5778FECC /* 87.120.254.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5778FEF5 /* 87.120.254.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57806FBE /* 87.128.111.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57847BCB /* 87.132.123.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5784C8BC /* 87.132.200.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5786449E /* 87.134.68.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x578B21D9 /* 87.139.33.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x578B8B03 /* 87.139.139.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x578E63CC /* 87.142.99.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x578E6FB2 /* 87.142.111.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x578E7868 /* 87.142.120.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5793BF8D /* 87.147.191.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57948874 /* 87.148.136.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5796D6BD /* 87.150.214.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57987F6D /* 87.152.127.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5799207E /* 87.153.32.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x579C9AF5 /* 87.156.154.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x579DB391 /* 87.157.179.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x579F3CFD /* 87.159.60.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x579F5887 /* 87.159.88.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x579FBE89 /* 87.159.190.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x579FEBA5 /* 87.159.235.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57A247EF /* 87.162.71.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57A2C503 /* 87.162.197.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57A618C6 /* 87.166.24.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57A631E2 /* 87.166.49.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57AA8B6E /* 87.170.139.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57ABDF9F /* 87.171.223.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57AC14FA /* 87.172.20.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57ADD49F /* 87.173.212.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57AE6C25 /* 87.174.108.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57AECCC6 /* 87.174.204.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57AEE042 /* 87.174.224.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57AEFD48 /* 87.174.253.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57B18038 /* 87.177.128.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57B3C9DB /* 87.179.201.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57B4E2EE /* 87.180.226.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57B528B4 /* 87.181.40.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57B55BD9 /* 87.181.91.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57B6D189 /* 87.182.209.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57B91C30 /* 87.185.28.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57BA2215 /* 87.186.34.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57C1B3EE /* 87.193.179.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57C1D00E /* 87.193.208.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57D63AC8 /* 87.214.58.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57D8ABB3 /* 87.216.171.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57DECE2D /* 87.222.206.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57E61995 /* 87.230.25.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57ECC217 /* 87.236.194.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57ECD71E /* 87.236.215.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57ECD753 /* 87.236.215.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x57FE5C78 /* 87.254.92.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5805A5DF /* 88.5.165.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x581B4113 /* 88.27.65.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x584187CD /* 88.65.135.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x584567A9 /* 88.69.103.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58485BDA /* 88.72.91.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5849369E /* 88.73.54.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x584C47D4 /* 88.76.71.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x584E43A5 /* 88.78.67.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58500705 /* 88.80.7.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5850D6BD /* 88.80.214.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x585666A3 /* 88.86.102.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5859086D /* 88.89.8.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5862FCEA /* 88.98.252.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58630E5C /* 88.99.14.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x586315A3 /* 88.99.21.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x586315AB /* 88.99.21.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58631B83 /* 88.99.27.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58631BE7 /* 88.99.27.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58631FBA /* 88.99.31.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5863230C /* 88.99.35.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x586323B2 /* 88.99.35.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58632420 /* 88.99.36.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5863466B /* 88.99.70.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58634B5E /* 88.99.75.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5863504E /* 88.99.80.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x586353A3 /* 88.99.83.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x586356AE /* 88.99.86.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58635784 /* 88.99.87.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x586360E0 /* 88.99.96.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5863685E /* 88.99.104.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x586D1267 /* 88.109.18.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5873E58C /* 88.115.229.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x588B8C5B /* 88.139.140.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x588E30D8 /* 88.142.48.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5895B559 /* 88.149.181.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5898AB67 /* 88.152.171.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5898ED49 /* 88.152.237.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589C0AFD /* 88.156.10.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589CB6C4 /* 88.156.182.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589F2BF1 /* 88.159.43.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589F4DC4 /* 88.159.77.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589F8B11 /* 88.159.139.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589F8E93 /* 88.159.142.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589FA4F9 /* 88.159.164.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x589FF570 /* 88.159.245.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58A13860 /* 88.161.56.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58A7FEF1 /* 88.167.254.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58AE5A97 /* 88.174.90.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58B00C64 /* 88.176.12.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58B0B407 /* 88.176.180.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58B256CA /* 88.178.86.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58B3309A /* 88.179.48.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58B4AD3F /* 88.180.173.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58B99B86 /* 88.185.155.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BA120C /* 88.186.18.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BB785A /* 88.187.120.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BBE91B /* 88.187.233.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BCDCD1 /* 88.188.220.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BDCE35 /* 88.189.206.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BE765F /* 88.190.118.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BED2F0 /* 88.190.210.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BFCD30 /* 88.191.205.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58BFD421 /* 88.191.212.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C0FD11 /* 88.192.253.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C1997C /* 88.193.153.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C38F0D /* 88.195.143.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C60603 /* 88.198.6.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C60BAB /* 88.198.11.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C60D74 /* 88.198.13.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C61304 /* 88.198.19.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C617DD /* 88.198.23.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C62424 /* 88.198.36.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C62C91 /* 88.198.44.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C63436 /* 88.198.52.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6388C /* 88.198.56.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C66D95 /* 88.198.109.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C66EC2 /* 88.198.110.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C677C5 /* 88.198.119.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C67D60 /* 88.198.125.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C694FF /* 88.198.148.255/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6A4DB /* 88.198.164.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6C09C /* 88.198.192.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6C259 /* 88.198.194.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6CFDE /* 88.198.207.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6D403 /* 88.198.212.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6FD0D /* 88.198.253.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6FD18 /* 88.198.253.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C6FD1B /* 88.198.253.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C84964 /* 88.200.73.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58C99131 /* 88.201.145.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58CACA2A /* 88.202.202.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58CC70F2 /* 88.204.112.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58CC71BD /* 88.204.113.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D0794E /* 88.208.121.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D0F50A /* 88.208.245.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D4228D /* 88.212.34.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D74B9A /* 88.215.75.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D7BAB9 /* 88.215.186.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D96856 /* 88.217.104.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D98F35 /* 88.217.143.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x58D9ABE1 /* 88.217.171.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59002F22 /* 89.0.47.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59005227 /* 89.0.82.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59008F3F /* 89.0.143.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59036176 /* 89.3.97.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x590CB328 /* 89.12.179.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x590CCA35 /* 89.12.202.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x590DB50A /* 89.13.181.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5910B09E /* 89.16.176.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5912AC64 /* 89.18.172.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5912AC70 /* 89.18.172.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5912AD29 /* 89.18.173.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5916613A /* 89.22.97.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x591661C1 /* 89.22.97.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x591F393A /* 89.31.57.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x591F60A8 /* 89.31.96.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59207FB2 /* 89.32.127.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59210618 /* 89.33.6.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5921CF50 /* 89.33.207.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5921F672 /* 89.33.246.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5922ED15 /* 89.34.237.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5922ED65 /* 89.34.237.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5922ED79 /* 89.34.237.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5922ED88 /* 89.34.237.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5922EDC0 /* 89.34.237.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5923869A /* 89.35.134.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5923B268 /* 89.35.178.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5924DA7F /* 89.36.218.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5926D039 /* 89.38.208.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59274321 /* 89.39.67.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59284795 /* 89.40.71.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5928B56B /* 89.40.181.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x592D2394 /* 89.45.35.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x592D4389 /* 89.45.67.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x592DE21C /* 89.45.226.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x592E4662 /* 89.46.70.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x592E6447 /* 89.46.100.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x592E64A2 /* 89.46.100.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x594418D2 /* 89.68.24.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x594704AD /* 89.71.4.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5947A11E /* 89.71.161.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x594939B2 /* 89.73.57.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x595E01B3 /* 89.94.1.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59639B85 /* 89.99.155.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x596408AB /* 89.100.8.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5964217D /* 89.100.33.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59661F13 /* 89.102.31.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59668C7A /* 89.102.140.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59669309 /* 89.102.147.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59676FD9 /* 89.103.111.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x596B9BA2 /* 89.107.155.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x596DE24B /* 89.109.226.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x596E300A /* 89.110.48.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x596F1444 /* 89.111.20.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5980CD65 /* 89.128.205.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5984E1FA /* 89.132.225.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59857E05 /* 89.133.126.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59900C0F /* 89.144.12.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5996AE32 /* 89.150.174.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x599F5484 /* 89.159.84.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A1600E /* 89.161.96.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3803B /* 89.163.128.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A38042 /* 89.163.128.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3864C /* 89.163.134.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A38D73 /* 89.163.141.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A38D74 /* 89.163.141.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A38DEF /* 89.163.141.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A39130 /* 89.163.145.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3925D /* 89.163.146.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3940D /* 89.163.148.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A39D4F /* 89.163.157.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A39F2C /* 89.163.159.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3C4DD /* 89.163.196.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3D2A3 /* 89.163.210.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3D2A4 /* 89.163.210.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3D83C /* 89.163.216.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3D926 /* 89.163.217.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3DB1B /* 89.163.219.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3DB76 /* 89.163.219.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E019 /* 89.163.224.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E0BB /* 89.163.224.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E0D4 /* 89.163.224.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E0FA /* 89.163.224.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E106 /* 89.163.225.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E107 /* 89.163.225.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E173 /* 89.163.225.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E191 /* 89.163.225.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3E1B8 /* 89.163.225.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F574 /* 89.163.245.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F5B5 /* 89.163.245.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F5B8 /* 89.163.245.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F5C7 /* 89.163.245.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F67F /* 89.163.246.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F72B /* 89.163.247.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F9C8 /* 89.163.249.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A3F9C9 /* 89.163.249.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A6609C /* 89.166.96.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59A67C0D /* 89.166.124.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59AC81D1 /* 89.172.129.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59AF1BA3 /* 89.175.27.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59B011EA /* 89.176.17.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59B2AAE4 /* 89.178.170.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59B377A5 /* 89.179.119.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59B37F7C /* 89.179.127.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59B74400 /* 89.183.68.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59BB8ED0 /* 89.187.142.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59BB8F51 /* 89.187.143.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59BB907A /* 89.187.144.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59BB9167 /* 89.187.145.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59BFC7F5 /* 89.191.199.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59BFD901 /* 89.191.217.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59CF8196 /* 89.207.129.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59DDD040 /* 89.221.208.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59DDD08A /* 89.221.208.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59DDD164 /* 89.221.209.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59DDD27A /* 89.221.210.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59DDD297 /* 89.221.210.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59DF1BF1 /* 89.223.27.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59EA9DFE /* 89.234.157.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59EAB76E /* 89.234.183.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59EABA24 /* 89.234.186.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59EC2275 /* 89.236.34.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59EE59C5 /* 89.238.89.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59F6CC36 /* 89.246.204.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59F8A69D /* 89.248.166.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59F8AAE3 /* 89.248.170.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x59F94106 /* 89.249.65.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A0106B5 /* 90.1.6.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A06197C /* 90.6.25.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A2C5DDA /* 90.44.93.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A3FDA8B /* 90.63.218.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A416676 /* 90.65.102.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A4E1922 /* 90.78.25.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A4F659A /* 90.79.101.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A573FAD /* 90.87.63.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A685368 /* 90.104.83.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A6896BF /* 90.104.150.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A69A893 /* 90.105.168.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A700D78 /* 90.112.13.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A708FA7 /* 90.112.143.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A7887A8 /* 90.120.135.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5A7EADC0 /* 90.126.173.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5AB8DE76 /* 90.184.222.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5AB8EF9A /* 90.184.239.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ABC1BB8 /* 90.188.27.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ABF645B /* 90.191.100.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5AD0B354 /* 90.208.179.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ADC0A6E /* 90.220.10.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5AE150DB /* 90.225.80.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5AE2B287 /* 90.226.178.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5AE68576 /* 90.230.133.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B007B9F /* 91.0.123.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B015603 /* 91.1.86.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B02AA6E /* 91.2.170.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B054CD4 /* 91.5.76.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B0846A3 /* 91.8.70.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B08D86F /* 91.8.216.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B09CB9D /* 91.9.203.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B0B28ED /* 91.11.40.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B1155E2 /* 91.17.85.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B12557C /* 91.18.85.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B12EA5A /* 91.18.234.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B13E9CF /* 91.19.233.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B147FDA /* 91.20.127.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B156D49 /* 91.21.109.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B208735 /* 91.32.135.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B20C025 /* 91.32.192.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B228FDD /* 91.34.143.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B2529A9 /* 91.37.41.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B293947 /* 91.41.57.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B298B37 /* 91.41.139.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B2A4735 /* 91.42.71.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B2AB21C /* 91.42.178.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B2D864A /* 91.45.134.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B31245C /* 91.49.36.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B339017 /* 91.51.144.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B352D2B /* 91.53.45.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B36C44C /* 91.54.196.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B3B43E1 /* 91.59.67.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B3BBE64 /* 91.59.190.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B3E5239 /* 91.62.82.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B3FA90B /* 91.63.169.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B40007D /* 91.64.0.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B408F14 /* 91.64.143.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B40A481 /* 91.64.164.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B40D118 /* 91.64.209.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B40FE7E /* 91.64.254.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B413DD9 /* 91.65.61.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B41A679 /* 91.65.166.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B42816A /* 91.66.129.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B436D56 /* 91.67.109.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B43858C /* 91.67.133.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B439B7F /* 91.67.155.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B4F1C58 /* 91.79.28.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B59FDD8 /* 91.89.253.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B600FC2 /* 91.96.15.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B61B4F8 /* 91.97.180.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6467C4 /* 91.100.103.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B69CB5C /* 91.105.203.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6A8BE1 /* 91.106.139.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6AAB1D /* 91.106.171.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6AAC3A /* 91.106.172.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6AAD4B /* 91.106.173.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6B68EE /* 91.107.104.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6B692E /* 91.107.105.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6D1DF1 /* 91.109.29.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B6D9C46 /* 91.109.156.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B720536 /* 91.114.5.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B790114 /* 91.121.1.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B790E99 /* 91.121.14.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B791043 /* 91.121.16.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B791764 /* 91.121.23.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B791C40 /* 91.121.28.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B791C42 /* 91.121.28.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B793608 /* 91.121.54.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B794CAF /* 91.121.76.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B794D25 /* 91.121.77.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B794FBC /* 91.121.79.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B795198 /* 91.121.81.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B795219 /* 91.121.82.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79536C /* 91.121.83.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B795489 /* 91.121.84.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B795582 /* 91.121.85.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B795DA0 /* 91.121.93.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79623A /* 91.121.98.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B796C40 /* 91.121.108.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B797168 /* 91.121.113.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B797422 /* 91.121.116.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79777A /* 91.121.119.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B7985E1 /* 91.121.133.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B798884 /* 91.121.136.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B799341 /* 91.121.147.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B799991 /* 91.121.153.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B799B21 /* 91.121.155.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B799E11 /* 91.121.158.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B799F24 /* 91.121.159.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79A006 /* 91.121.160.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79A698 /* 91.121.166.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79C09A /* 91.121.192.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79C384 /* 91.121.195.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79C3A9 /* 91.121.195.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79D144 /* 91.121.209.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79E00A /* 91.121.224.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79E6D0 /* 91.121.230.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79E6D2 /* 91.121.230.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79E6D4 /* 91.121.230.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79E6D6 /* 91.121.230.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79E6D8 /* 91.121.230.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B79E6DA /* 91.121.230.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B7A1FAF /* 91.122.31.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B7A2FEA /* 91.122.47.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B7A34ED /* 91.122.52.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B7A640D /* 91.122.100.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B7D1BBB /* 91.125.27.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B7E2D22 /* 91.126.45.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B868558 /* 91.134.133.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86870C /* 91.134.135.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86886B /* 91.134.136.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B868963 /* 91.134.137.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B868BC8 /* 91.134.139.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B868BCF /* 91.134.139.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B868BD7 /* 91.134.139.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B869BF4 /* 91.134.155.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86B4F0 /* 91.134.180.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86D8A0 /* 91.134.216.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86DAB0 /* 91.134.218.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86E830 /* 91.134.232.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86E831 /* 91.134.232.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B86F3AD /* 91.134.243.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B88A4E3 /* 91.136.164.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B8A1429 /* 91.138.20.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B8A47EC /* 91.138.71.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B8F50DC /* 91.143.80.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B8F5B7D /* 91.143.91.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B8F5B8E /* 91.143.91.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B9107E2 /* 91.145.7.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B91765D /* 91.145.118.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B927903 /* 91.146.121.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B927A2D /* 91.146.122.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B98713E /* 91.152.113.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5B9A47D8 /* 91.154.71.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BA07B04 /* 91.160.123.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BB171C0 /* 91.177.113.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BBA0896 /* 91.186.8.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BBA3E92 /* 91.186.62.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BBC7D80 /* 91.188.125.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BBE754D /* 91.190.117.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BBEEA42 /* 91.190.234.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BC25A67 /* 91.194.90.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BC5EA66 /* 91.197.234.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BC5EA6A /* 91.197.234.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BC6D4FA /* 91.198.212.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BC80D07 /* 91.200.13.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCA2969 /* 91.202.41.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCA2EBD /* 91.202.46.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCAA8B8 /* 91.202.168.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCAA8B9 /* 91.202.168.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCB0592 /* 91.203.5.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCB05A1 /* 91.203.5.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCB05A5 /* 91.203.5.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCB927E /* 91.203.146.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCDAD52 /* 91.205.173.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BCDAF8A /* 91.205.175.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD2685B /* 91.210.104.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD26A86 /* 91.210.106.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD36BAC /* 91.211.107.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD3F770 /* 91.211.247.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD50854 /* 91.213.8.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD50859 /* 91.213.8.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD50865 /* 91.213.8.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD508EB /* 91.213.8.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD508EC /* 91.213.8.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD5E93C /* 91.213.233.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD5E96B /* 91.213.233.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD5E98A /* 91.213.233.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BD6A945 /* 91.214.169.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDB1C55 /* 91.219.28.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDB1C63 /* 91.219.28.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDB1CD3 /* 91.219.28.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDB1D8E /* 91.219.29.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDB1D9D /* 91.219.29.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDB1DBC /* 91.219.29.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDB1DEE /* 91.219.29.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBECAE /* 91.219.236.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBECDA /* 91.219.236.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBECE8 /* 91.219.236.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBECFA /* 91.219.236.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBED13 /* 91.219.237.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBED75 /* 91.219.237.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBED9A /* 91.219.237.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBEDE5 /* 91.219.237.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBEDEB /* 91.219.237.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBEDF4 /* 91.219.237.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBEEDD /* 91.219.238.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBEF5C /* 91.219.239.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDBEFFA /* 91.219.239.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDCDC05 /* 91.220.220.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDD42DC /* 91.221.66.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDD7721 /* 91.221.119.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDF529C /* 91.223.82.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDF6A59 /* 91.223.106.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BDF6A5A /* 91.223.106.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE09521 /* 91.224.149.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE09C75 /* 91.224.156.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE09D63 /* 91.224.157.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE434BA /* 91.228.52.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE43556 /* 91.228.53.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE5141B /* 91.229.20.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE54C7C /* 91.229.76.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE6CC50 /* 91.230.204.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE75665 /* 91.231.86.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE756CC /* 91.231.86.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE8E12B /* 91.232.225.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE96A79 /* 91.233.106.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE96A91 /* 91.233.106.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE96AAC /* 91.233.106.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE96AED /* 91.233.106.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE97433 /* 91.233.116.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE97477 /* 91.233.116.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BE985F7 /* 91.233.133.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BEB8832 /* 91.235.136.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BEC7457 /* 91.236.116.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BEC745D /* 91.236.116.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BEC745E /* 91.236.116.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BECEF87 /* 91.236.239.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BECEF8C /* 91.236.239.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BECFB15 /* 91.236.251.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BECFB18 /* 91.236.251.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BECFB1E /* 91.236.251.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BECFB2A /* 91.236.251.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BECFB48 /* 91.236.251.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BED34AA /* 91.237.52.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BED5867 /* 91.237.88.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BED58B5 /* 91.237.88.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BEDF43E /* 91.237.244.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BEDF73E /* 91.237.247.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BEFE851 /* 91.239.232.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BF04305 /* 91.240.67.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BF0E5C3 /* 91.240.229.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BF2A3BA /* 91.242.163.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BF3CB50 /* 91.243.203.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BF3D521 /* 91.243.213.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BF7FB1A /* 91.247.251.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BF817F0 /* 91.248.23.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5BFA75FC /* 91.250.117.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C1B07D1 /* 92.27.7.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C267E8C /* 92.38.126.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C26AD50 /* 92.38.173.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C27F62D /* 92.39.246.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C32A1F6 /* 92.50.161.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C33F583 /* 92.51.245.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C3FACF7 /* 92.63.172.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C3FAD18 /* 92.63.173.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C3FAE24 /* 92.63.174.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C3FAE47 /* 92.63.174.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C4BBA9C /* 92.75.186.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C4C66DE /* 92.76.102.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C59523D /* 92.89.82.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C5E640B /* 92.94.100.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C5F4274 /* 92.95.66.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C648326 /* 92.100.131.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C6CC255 /* 92.108.194.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C6D527B /* 92.109.82.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C6F04B1 /* 92.111.4.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C6F59EE /* 92.111.89.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5C824D96 /* 92.130.77.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CA75FDB /* 92.167.95.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CA78C44 /* 92.167.140.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CA916D1 /* 92.169.22.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CC344A6 /* 92.195.68.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CC905E2 /* 92.201.5.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CCC0195 /* 92.204.1.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CCE1A1D /* 92.206.26.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CD3274D /* 92.211.39.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDC4808 /* 92.220.72.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDC4ED7 /* 92.220.78.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDD5AA1 /* 92.221.90.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDDC98A /* 92.221.201.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE0466 /* 92.222.4.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE060C /* 92.222.6.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE1482 /* 92.222.20.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE1625 /* 92.222.22.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE1671 /* 92.222.22.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE17C2 /* 92.222.23.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE19BF /* 92.222.25.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE1AD8 /* 92.222.26.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE1CF3 /* 92.222.28.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE2643 /* 92.222.38.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE27B7 /* 92.222.39.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE27C4 /* 92.222.39.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE4519 /* 92.222.69.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE45AD /* 92.222.69.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE46AC /* 92.222.70.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE4ACB /* 92.222.74.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE4AE2 /* 92.222.74.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE5488 /* 92.222.84.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE55AB /* 92.222.85.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE59BF /* 92.222.89.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE5A9C /* 92.222.90.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE5CFA /* 92.222.92.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE5E33 /* 92.222.94.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE67E8 /* 92.222.103.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE67E9 /* 92.222.103.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE731C /* 92.222.115.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDE9993 /* 92.222.153.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDEA236 /* 92.222.162.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDEB457 /* 92.222.180.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDEB568 /* 92.222.181.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDEB57B /* 92.222.181.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CDECC60 /* 92.222.204.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CE0048E /* 92.224.4.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CE0AC08 /* 92.224.172.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CE10812 /* 92.225.8.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF228C0 /* 92.242.40.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF24A87 /* 92.242.74.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF3141E /* 92.243.20.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF31ED0 /* 92.243.30.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF34569 /* 92.243.69.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF41F1C /* 92.244.31.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF733A9 /* 92.247.51.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF8E784 /* 92.248.231.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF98F77 /* 92.249.143.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CF9955F /* 92.249.149.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CFE3951 /* 92.254.57.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CFFB08A /* 92.255.176.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CFFCF59 /* 92.255.207.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5CFFFB42 /* 92.255.251.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D1B3351 /* 93.27.51.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D32BA03 /* 93.50.186.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D3A0B18 /* 93.58.11.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D40CF37 /* 93.64.207.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D41D51F /* 93.65.213.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D42D1BC /* 93.66.209.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D492760 /* 93.73.39.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D4A2AE6 /* 93.74.42.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D59651B /* 93.89.101.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5CCB71 /* 93.92.203.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5F64A4 /* 93.95.100.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5F64A6 /* 93.95.100.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5F64CA /* 93.95.100.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5F64CB /* 93.95.100.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5FE3F5 /* 93.95.227.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5FE431 /* 93.95.228.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D5FE450 /* 93.95.228.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D648EB6 /* 93.100.142.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D64D3D8 /* 93.100.211.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D67E349 /* 93.103.227.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D68762D /* 93.104.118.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D68A579 /* 93.104.165.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D68D06A /* 93.104.208.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D68D120 /* 93.104.209.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D68D19E /* 93.104.209.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D68D33E /* 93.104.211.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D68D541 /* 93.104.213.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D71AF19 /* 93.113.175.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D731B34 /* 93.115.27.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D731C0D /* 93.115.28.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D731D56 /* 93.115.29.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D73548F /* 93.115.84.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735B42 /* 93.115.91.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735F26 /* 93.115.95.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735FC9 /* 93.115.95.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735FCA /* 93.115.95.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735FCC /* 93.115.95.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735FCD /* 93.115.95.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735FCE /* 93.115.95.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735FCF /* 93.115.95.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D735FD8 /* 93.115.95.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D7361F2 /* 93.115.97.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D73F102 /* 93.115.241.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D73F132 /* 93.115.241.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D73F1C2 /* 93.115.241.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D760102 /* 93.118.1.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D7B5A0D /* 93.123.90.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D7BE197 /* 93.123.225.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D81296E /* 93.129.41.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D989FDF /* 93.152.159.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D9D3316 /* 93.157.51.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D9ED834 /* 93.158.216.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D9ED83F /* 93.158.216.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5D9ED88E /* 93.158.216.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DAA4D94 /* 93.170.77.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DAA4DAE /* 93.170.77.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DAA4DDF /* 93.170.77.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DAA4DE7 /* 93.170.77.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DAAA93E /* 93.170.169.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DAE5D85 /* 93.174.93.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB4882B /* 93.180.136.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB49A5E /* 93.180.154.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB49C54 /* 93.180.156.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB49D9A /* 93.180.157.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB5035B /* 93.181.3.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB81462 /* 93.184.20.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB81E14 /* 93.184.30.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB842E3 /* 93.184.66.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DB96DBF /* 93.185.109.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBA0E46 /* 93.186.14.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBAC844 /* 93.186.200.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBAC8D5 /* 93.186.200.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBACAC3 /* 93.186.202.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBACAF1 /* 93.186.202.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBD1A16 /* 93.189.26.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBD5AF4 /* 93.189.90.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBE5F18 /* 93.190.95.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DBE8D73 /* 93.190.141.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DC27838 /* 93.194.120.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DC4E9F0 /* 93.196.233.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DC5F186 /* 93.197.241.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DCBFEFE /* 93.203.254.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DCDACFE /* 93.205.172.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DCDE0CA /* 93.205.224.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DCE42BD /* 93.206.66.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DCF77FA /* 93.207.119.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DD12CEB /* 93.209.44.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DD1A8B8 /* 93.209.168.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DD3D5CF /* 93.211.213.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DD4544A /* 93.212.84.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DD77920 /* 93.215.121.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DDA60B7 /* 93.218.96.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DDB4A99 /* 93.219.74.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DDB4F18 /* 93.219.79.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DDEE4A5 /* 93.222.228.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DDF73C6 /* 93.223.115.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE03EA0 /* 93.224.62.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE1B52D /* 93.225.181.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE32C29 /* 93.227.44.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE38F2B /* 93.227.143.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE44117 /* 93.228.65.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE79F0B /* 93.231.159.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE7E5FC /* 93.231.229.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE8FF95 /* 93.232.255.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DE98875 /* 93.233.136.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DEAADD4 /* 93.234.173.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DECF646 /* 93.236.246.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DED9761 /* 93.237.151.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DED9CAC /* 93.237.156.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DEF2BAB /* 93.239.43.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5DF42B23 /* 93.244.43.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E108907 /* 94.16.137.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E10AD6A /* 94.16.173.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E15EB8D /* 94.21.235.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E16C5B3 /* 94.22.197.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1701A4 /* 94.23.1.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1707A1 /* 94.23.7.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17113A /* 94.23.17.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1712A9 /* 94.23.18.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17141C /* 94.23.20.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E171DCC /* 94.23.29.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E179031 /* 94.23.144.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1799F1 /* 94.23.153.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E179A24 /* 94.23.154.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17A526 /* 94.23.165.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17AD5D /* 94.23.173.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17ADF9 /* 94.23.173.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17AE1A /* 94.23.174.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17CCAF /* 94.23.204.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17DBC0 /* 94.23.219.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17DC58 /* 94.23.220.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17F72A /* 94.23.247.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E17F89E /* 94.23.248.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1A5862 /* 94.26.88.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1A8C96 /* 94.26.140.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1CF47B /* 94.28.244.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E1F35CB /* 94.31.53.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E225DB0 /* 94.34.93.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E2E0D0B /* 94.46.13.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E2E52EC /* 94.46.82.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E32882A /* 94.50.136.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E3CFF2A /* 94.60.255.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E3DCC41 /* 94.61.204.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E4A5171 /* 94.74.81.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E4BE8F2 /* 94.75.232.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E4F89B6 /* 94.79.137.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E4FADE2 /* 94.79.173.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E640617 /* 94.100.6.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E64061B /* 94.100.6.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E6415A2 /* 94.100.21.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E641712 /* 94.100.23.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E64171A /* 94.100.23.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E66322A /* 94.102.50.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E663C55 /* 94.102.60.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E70D94D /* 94.112.217.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E72ACDC /* 94.114.172.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E7EAAA5 /* 94.126.170.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E897888 /* 94.137.120.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E8C7868 /* 94.140.120.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E8C7882 /* 94.140.120.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E8C7A16 /* 94.140.122.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E8EF18A /* 94.142.241.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E8EF254 /* 94.142.242.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E8EF5CE /* 94.142.245.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E9B312F /* 94.155.49.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E9C4DC0 /* 94.156.77.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E9C800A /* 94.156.128.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5E9CAF78 /* 94.156.175.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EB08BBA /* 94.176.139.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EB1E450 /* 94.177.228.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EB1EAF3 /* 94.177.234.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EB52C2D /* 94.181.44.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EB52DED /* 94.181.45.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EB95A56 /* 94.185.90.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EC1F171 /* 94.193.241.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EC6445C /* 94.198.68.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EC66218 /* 94.198.98.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EC66247 /* 94.198.98.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EC66411 /* 94.198.100.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EC66412 /* 94.198.100.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ED1AF86 /* 94.209.175.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ED1C399 /* 94.209.195.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ED57791 /* 94.213.119.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ED6CC43 /* 94.214.204.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5ED8790D /* 94.216.121.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EDABF26 /* 94.218.191.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EDB188C /* 94.219.24.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EDF9D93 /* 94.223.157.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EE02CA2 /* 94.224.44.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EE16454 /* 94.225.100.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EE26BA5 /* 94.226.107.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EE4560B /* 94.228.86.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EE45790 /* 94.228.87.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EE8AE42 /* 94.232.174.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EECF049 /* 94.236.240.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF12A9C /* 94.241.42.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23902 /* 94.242.57.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23954 /* 94.242.57.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23970 /* 94.242.57.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF239A1 /* 94.242.57.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF239D4 /* 94.242.57.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23A02 /* 94.242.58.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23A97 /* 94.242.58.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23AE9 /* 94.242.58.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23B2F /* 94.242.59.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23B93 /* 94.242.59.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23BB6 /* 94.242.59.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF23BBB /* 94.242.59.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2D178 /* 94.242.209.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2D179 /* 94.242.209.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2D1F4 /* 94.242.209.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2DE19 /* 94.242.222.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2DE81 /* 94.242.222.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2DED9 /* 94.242.222.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2E4AE /* 94.242.228.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2F617 /* 94.242.246.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2F618 /* 94.242.246.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2FA76 /* 94.242.250.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF2FF70 /* 94.242.255.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EF53531 /* 94.245.53.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EFD0CCB /* 94.253.12.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EFDB1E7 /* 94.253.177.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EFE121F /* 94.254.18.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EFE1905 /* 94.254.25.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EFE56CC /* 94.254.86.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5EFE5E9B /* 94.254.94.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F199543 /* 95.25.149.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1B83EE /* 95.27.131.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1BA3AC /* 95.27.163.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1BC4E5 /* 95.27.196.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1C06B0 /* 95.28.6.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1C290B /* 95.28.41.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1C3802 /* 95.28.56.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1F0EA0 /* 95.31.14.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1F1892 /* 95.31.24.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1F26D1 /* 95.31.38.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1F7F71 /* 95.31.127.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F1FF207 /* 95.31.242.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F26CA17 /* 95.38.202.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F2A7EA7 /* 95.42.126.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F2E6211 /* 95.46.98.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F45E818 /* 95.69.232.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F479350 /* 95.71.147.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F47F93B /* 95.71.249.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F4947DE /* 95.73.71.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F4968B5 /* 95.73.104.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F4F6007 /* 95.79.96.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F502D4A /* 95.80.45.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F54A422 /* 95.84.164.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F54D17E /* 95.84.209.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F550171 /* 95.85.1.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5503BF /* 95.85.3.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5508E2 /* 95.85.8.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F550A47 /* 95.85.10.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F55132E /* 95.85.19.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5513A2 /* 95.85.19.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F551449 /* 95.85.20.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5516AD /* 95.85.22.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F55200A /* 95.85.32.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F55256F /* 95.85.37.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F553236 /* 95.85.50.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5820BA /* 95.88.32.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F585BC5 /* 95.88.91.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F59EB89 /* 95.89.235.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5AB216 /* 95.90.178.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5B057D /* 95.91.5.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5B1017 /* 95.91.16.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5B222D /* 95.91.34.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F5B95DA /* 95.91.149.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F69A49D /* 95.105.164.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F6C7B1D /* 95.108.123.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F6D7A90 /* 95.109.122.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F722090 /* 95.114.32.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F77AD1B /* 95.119.173.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F7B33AC /* 95.123.51.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F802BA4 /* 95.128.43.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8137AD /* 95.129.55.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F820B05 /* 95.130.11.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F820B0F /* 95.130.11.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F820B93 /* 95.130.11.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F820BAA /* 95.130.11.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F820BBA /* 95.130.11.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F820C1F /* 95.130.12.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F820C77 /* 95.130.12.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F841A81 /* 95.132.26.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8C2AB7 /* 95.140.42.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8D230F /* 95.141.35.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8D5392 /* 95.141.83.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8EA0E9 /* 95.142.160.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8EA13F /* 95.142.161.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8EAD12 /* 95.142.173.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8FAC8C /* 95.143.172.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8FAC93 /* 95.143.172.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8FACBC /* 95.143.172.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8FACD4 /* 95.143.172.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8FACD6 /* 95.143.172.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8FACE3 /* 95.143.172.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F8FC191 /* 95.143.193.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F9281D1 /* 95.146.129.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F9749C7 /* 95.151.73.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F9914D4 /* 95.153.20.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F991F08 /* 95.153.31.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5F9C5F08 /* 95.156.95.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA37923 /* 95.163.121.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA37997 /* 95.163.121.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA58516 /* 95.165.133.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA58F70 /* 95.165.143.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA5940C /* 95.165.148.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA88A56 /* 95.168.138.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA894E9 /* 95.168.148.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FA9BC67 /* 95.169.188.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FACEC3F /* 95.172.236.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FAEE6C9 /* 95.174.230.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB7300C /* 95.183.48.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB73081 /* 95.183.48.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB730B4 /* 95.183.48.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB7328A /* 95.183.50.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB732D0 /* 95.183.50.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB7337E /* 95.183.51.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB734AC /* 95.183.52.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FB73735 /* 95.183.55.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD0AFA1 /* 95.208.175.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3079E /* 95.211.7.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD31B84 /* 95.211.27.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD376C2 /* 95.211.118.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD38A07 /* 95.211.138.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD38A33 /* 95.211.138.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD39362 /* 95.211.147.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3A094 /* 95.211.160.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3BA50 /* 95.211.186.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3CD8A /* 95.211.205.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3D149 /* 95.211.209.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3D248 /* 95.211.210.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3D809 /* 95.211.216.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3E00C /* 95.211.224.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3E1A7 /* 95.211.225.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3E242 /* 95.211.226.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD3E65E /* 95.211.230.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD5C3AB /* 95.213.195.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD5CAB2 /* 95.213.202.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD5FB52 /* 95.213.251.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72C66 /* 95.215.44.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72C69 /* 95.215.44.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72CA7 /* 95.215.44.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72CC2 /* 95.215.44.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72CE8 /* 95.215.44.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72D44 /* 95.215.45.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72D8E /* 95.215.45.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72DBC /* 95.215.45.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72E2E /* 95.215.46.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72E45 /* 95.215.46.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72E7B /* 95.215.46.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72EF2 /* 95.215.46.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72EF4 /* 95.215.46.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72F4B /* 95.215.47.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72F96 /* 95.215.47.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD72FFB /* 95.215.47.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FD73D04 /* 95.215.61.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FDC073C /* 95.220.7.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FDCDFA9 /* 95.220.223.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FDF4CB8 /* 95.223.76.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x5FEB08A7 /* 95.235.8.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6009F230 /* 96.9.242.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6012AAD4 /* 96.18.170.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x602112CA /* 96.33.18.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60238285 /* 96.35.130.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x602785DB /* 96.39.133.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x602B82B2 /* 96.43.130.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x602FEF99 /* 96.47.239.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6034D4A3 /* 96.52.212.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x604144C1 /* 96.65.68.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60417BF9 /* 96.65.123.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60420F93 /* 96.66.15.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60553F29 /* 96.85.63.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60559BD9 /* 96.85.155.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60598D1D /* 96.89.141.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x605B0B51 /* 96.91.11.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x605C7632 /* 96.92.118.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x607E6009 /* 96.126.96.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x607E605A /* 96.126.96.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x607E69DB /* 96.126.105.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x607E7AA6 /* 96.126.122.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x607E7DBB /* 96.126.125.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60E94CE8 /* 96.233.76.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60EB82FC /* 96.235.130.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60ED40D5 /* 96.237.64.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60EF7A14 /* 96.239.122.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60F20D06 /* 96.242.13.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60F29FB1 /* 96.242.159.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60F2FC93 /* 96.242.252.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60F805AC /* 96.248.5.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60F9FE16 /* 96.249.254.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60FD4E6C /* 96.253.78.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x60FF478B /* 96.255.71.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x614AEDC4 /* 97.74.237.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x61520CB7 /* 97.82.12.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x61553F86 /* 97.85.63.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x615E705B /* 97.94.112.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x615F230D /* 97.95.35.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x615FD82C /* 97.95.216.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x616B8418 /* 97.107.132.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x616B867F /* 97.107.134.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x616B8A44 /* 97.107.138.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x616B8B1C /* 97.107.139.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x616B8B6C /* 97.107.139.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x616B8E85 /* 97.107.142.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x616B8EEA /* 97.107.142.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x61785EA3 /* 97.120.94.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x617EC6DC /* 97.126.198.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x617F1B73 /* 97.127.27.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x621A2219 /* 98.26.34.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x621A3022 /* 98.26.48.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6273D502 /* 98.115.213.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62A404DF /* 98.164.4.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62B50CA9 /* 98.181.12.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62C931E2 /* 98.201.49.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62D14F33 /* 98.209.79.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62D88697 /* 98.216.134.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62D90833 /* 98.217.8.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62D97962 /* 98.217.121.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62DB0831 /* 98.219.8.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62E19AB7 /* 98.225.154.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62E3E03A /* 98.227.224.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62EBB9A7 /* 98.235.185.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62ED8805 /* 98.237.136.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62F802E4 /* 98.248.2.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x62F82838 /* 98.248.40.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x63060E37 /* 99.6.14.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6334B0A2 /* 99.52.176.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x63474BAC /* 99.71.75.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x63F57360 /* 99.245.115.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x640069DB /* 100.0.105.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x640203AC /* 100.2.3.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6406B61E /* 100.6.182.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6408FAC3 /* 100.8.250.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x640B7706 /* 100.11.119.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x640F27AD /* 100.15.39.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x640F7203 /* 100.15.114.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6410DA28 /* 100.16.218.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x65377D0A /* 101.55.125.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x65648D37 /* 101.100.141.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x656490AE /* 101.100.144.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x65649FD6 /* 101.100.159.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67033D72 /* 103.3.61.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67084FE5 /* 103.8.79.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x670AC532 /* 103.10.197.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x670AC764 /* 103.10.199.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x670E2976 /* 103.14.41.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67193A22 /* 103.25.58.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x671B7C52 /* 103.27.124.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x671D4617 /* 103.29.70.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67233816 /* 103.35.56.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6729B13E /* 103.41.177.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6729B140 /* 103.41.177.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x672AE17E /* 103.42.225.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6738CF54 /* 103.56.207.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67C7103A /* 103.199.16.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67E26B10 /* 103.226.107.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67EADCC5 /* 103.234.220.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67ECC96E /* 103.236.201.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67FA49C3 /* 103.250.73.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x67FA49E8 /* 103.250.73.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68201531 /* 104.32.21.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68253D9F /* 104.37.61.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6825C09C /* 104.37.192.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68299523 /* 104.41.149.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6880E070 /* 104.128.224.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6880E249 /* 104.128.226.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6882A979 /* 104.130.169.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x688304ED /* 104.131.4.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68830BD6 /* 104.131.11.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68830C8B /* 104.131.12.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68831377 /* 104.131.19.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883177F /* 104.131.23.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68831C36 /* 104.131.28.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883248A /* 104.131.36.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68832A95 /* 104.131.42.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68832D66 /* 104.131.45.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x688341E1 /* 104.131.65.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x688342C2 /* 104.131.66.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883483D /* 104.131.72.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68835477 /* 104.131.84.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68835684 /* 104.131.86.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x688357B4 /* 104.131.87.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x688365FB /* 104.131.101.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68836AB5 /* 104.131.106.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68836C07 /* 104.131.108.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68836ECC /* 104.131.110.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68837B10 /* 104.131.123.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x688380F7 /* 104.131.128.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883811E /* 104.131.129.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68838282 /* 104.131.130.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68838C45 /* 104.131.140.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68839456 /* 104.131.148.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68839554 /* 104.131.149.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883B286 /* 104.131.178.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883B5AE /* 104.131.181.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883B815 /* 104.131.184.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883CC93 /* 104.131.204.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883CDC0 /* 104.131.205.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883CE17 /* 104.131.206.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6883F537 /* 104.131.245.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x689C3CA3 /* 104.156.60.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x689C3CA6 /* 104.156.60.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x689C66C8 /* 104.156.102.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x689CE053 /* 104.156.224.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x689CE299 /* 104.156.226.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x689CE688 /* 104.156.230.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A7645F /* 104.167.100.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A76D4D /* 104.167.109.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A774EA /* 104.167.116.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A83EAE /* 104.168.62.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A83ED1 /* 104.168.62.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A857A7 /* 104.168.87.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A8A722 /* 104.168.167.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68A92625 /* 104.169.38.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68BEA4AC /* 104.190.164.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68C00747 /* 104.192.7.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68C810E3 /* 104.200.16.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68C812F4 /* 104.200.18.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68C8142E /* 104.200.20.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68C8148E /* 104.200.20.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68CEED15 /* 104.206.237.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68CEED18 /* 104.206.237.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68CF802A /* 104.207.128.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68CF8069 /* 104.207.128.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68CF8514 /* 104.207.133.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68D12CF8 /* 104.209.44.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DC3938 /* 104.220.57.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF0138 /* 104.223.1.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF0CE9 /* 104.223.12.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF1097 /* 104.223.16.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF67BB /* 104.223.103.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF7A45 /* 104.223.122.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF7A73 /* 104.223.122.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF7AD5 /* 104.223.122.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68DF7AEF /* 104.223.122.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E0AD3A /* 104.224.173.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E8775D /* 104.232.119.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E9500F /* 104.233.80.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E953CE /* 104.233.83.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E95629 /* 104.233.86.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E95EB5 /* 104.233.94.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E96AD2 /* 104.233.106.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E97255 /* 104.233.114.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E9773E /* 104.233.119.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E9786C /* 104.233.120.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68E97B49 /* 104.233.123.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC1696 /* 104.236.22.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC21AE /* 104.236.33.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC2938 /* 104.236.41.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC2C85 /* 104.236.44.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC2CE0 /* 104.236.44.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC2E0A /* 104.236.46.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC3410 /* 104.236.52.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC46C8 /* 104.236.70.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC575A /* 104.236.87.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC656C /* 104.236.101.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC67A7 /* 104.236.103.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC6881 /* 104.236.104.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC830F /* 104.236.131.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC8D9C /* 104.236.141.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EC97A0 /* 104.236.151.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECAFCB /* 104.236.175.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECB6CD /* 104.236.182.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECB739 /* 104.236.183.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECC7D9 /* 104.236.199.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECE0E1 /* 104.236.224.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECE7C5 /* 104.236.231.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECEAB2 /* 104.236.234.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECF7DA /* 104.236.247.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECFCA9 /* 104.236.252.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ECFD26 /* 104.236.253.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68ED9CD6 /* 104.237.156.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EE86B8 /* 104.238.134.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EE9FBF /* 104.238.159.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EEA76F /* 104.238.167.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EEBC62 /* 104.238.188.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68EEBE82 /* 104.238.190.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68F323C4 /* 104.243.35.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68F44A0D /* 104.244.74.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68F44D8F /* 104.244.77.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68F4DFCC /* 104.244.223.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68F52450 /* 104.245.36.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x68FA976C /* 104.250.151.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x699E356E /* 105.158.53.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6AB91C19 /* 106.185.28.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6ABA7981 /* 106.186.121.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6ABB2565 /* 106.187.37.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6ABB2F11 /* 106.187.47.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6B02D620 /* 107.2.214.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6B041F6F /* 107.4.31.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6B0D7797 /* 107.13.119.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6B9EFF15 /* 107.158.255.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6B9EFF16 /* 107.158.255.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BA111B4 /* 107.161.17.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BA11271 /* 107.161.18.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BA11286 /* 107.161.18.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BA150C3 /* 107.161.80.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BA1AC97 /* 107.161.172.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA2047 /* 107.170.32.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA4E2A /* 107.170.78.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA4E53 /* 107.170.78.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA5CED /* 107.170.92.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA5D0D /* 107.170.93.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA6527 /* 107.170.101.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA6CDE /* 107.170.108.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA711C /* 107.170.113.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA71D4 /* 107.170.113.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA771F /* 107.170.119.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA8F75 /* 107.170.143.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA9607 /* 107.170.150.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA9950 /* 107.170.153.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAA9ED4 /* 107.170.158.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAABC9B /* 107.170.188.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAC10E /* 107.170.193.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAACD08 /* 107.170.205.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAD546 /* 107.170.213.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAE7A9 /* 107.170.231.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAE84B /* 107.170.232.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAF442 /* 107.170.244.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAF67B /* 107.170.246.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAF721 /* 107.170.247.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAAFD74 /* 107.170.253.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAC170B /* 107.172.23.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAD2B23 /* 107.173.43.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BAE3490 /* 107.174.52.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BB39941 /* 107.179.153.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BB59B83 /* 107.181.155.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BB5A60B /* 107.181.166.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BB5AE16 /* 107.181.174.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BB5AE54 /* 107.181.174.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BB5BBC7 /* 107.181.187.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BB6B3DC /* 107.182.179.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BBCBC39 /* 107.188.188.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BBF2ECC /* 107.191.46.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BBF2F57 /* 107.191.47.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BBF38C0 /* 107.191.56.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BBF672A /* 107.191.103.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BBF76AB /* 107.191.118.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BBF7EB8 /* 107.191.126.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6BD3F863 /* 107.211.248.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C0431B5 /* 108.4.49.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C0CC48C /* 108.12.196.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C1D0041 /* 108.29.0.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C1F2805 /* 108.31.40.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C1FA9E8 /* 108.31.169.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C203114 /* 108.32.49.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C2304B7 /* 108.35.4.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C2929C7 /* 108.41.41.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C2E22E8 /* 108.46.34.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C331A8D /* 108.51.26.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C339122 /* 108.51.145.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C33EC02 /* 108.51.236.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C35D09D /* 108.53.208.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3A90EA /* 108.58.144.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3B02D0 /* 108.59.2.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3D6027 /* 108.61.96.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3D60E6 /* 108.61.96.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3D6307 /* 108.61.99.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3D6395 /* 108.61.99.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3D774B /* 108.61.119.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3DA500 /* 108.61.165.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3DA5A9 /* 108.61.165.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3DA7D3 /* 108.61.167.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3DB64A /* 108.61.182.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3DBE8B /* 108.61.190.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C3DD44E /* 108.61.212.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6C55630A /* 108.85.99.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CA185BD /* 108.161.133.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CA2AB42 /* 108.162.171.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CA84202 /* 108.168.66.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CAA920A /* 108.170.146.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CAA9FFB /* 108.170.159.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CAF02CD /* 108.175.2.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CAF0BE6 /* 108.175.11.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CB80514 /* 108.184.5.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CF0B68C /* 108.240.182.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6CF857F2 /* 108.248.87.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D00AA2D /* 109.0.170.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D08CFA6 /* 109.8.207.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D18C1D8 /* 109.24.193.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D18DC07 /* 109.24.220.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D1EC5DE /* 109.30.197.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D3FEBB6 /* 109.63.235.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D44AE3C /* 109.68.174.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D44BF84 /* 109.68.191.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D44BF85 /* 109.68.191.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D454311 /* 109.69.67.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D4676A4 /* 109.70.118.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D4AC3BE /* 109.74.195.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D4ACE15 /* 109.74.206.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D4BB84D /* 109.75.184.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D5A0231 /* 109.90.2.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D5A4BC0 /* 109.90.75.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D5A6963 /* 109.90.105.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D5AB5BD /* 109.90.181.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D5B73C8 /* 109.91.115.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D6832B3 /* 109.104.50.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D696DA2 /* 109.105.109.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D6A3DF9 /* 109.106.61.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D6B239A /* 109.107.35.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D6C0357 /* 109.108.3.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D6C1DF2 /* 109.108.29.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D78B4F5 /* 109.120.180.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D78B5B1 /* 109.120.181.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D7E09E4 /* 109.126.9.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D806B66 /* 109.128.107.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D8086E1 /* 109.128.134.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D827E43 /* 109.130.126.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D914022 /* 109.145.64.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D92A821 /* 109.146.168.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D948254 /* 109.148.130.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D94B389 /* 109.148.179.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D9657AC /* 109.150.87.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D9CC5B9 /* 109.156.197.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6D9DDFF9 /* 109.157.223.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA3EA02 /* 109.163.234.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA3EA04 /* 109.163.234.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA3EA05 /* 109.163.234.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA3EA07 /* 109.163.234.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA3EA08 /* 109.163.234.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA3EA09 /* 109.163.234.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA4ECE7 /* 109.164.236.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DA921A3 /* 109.169.33.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DAD29A1 /* 109.173.41.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DAD3936 /* 109.173.57.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DAD39A9 /* 109.173.57.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DAD4CF8 /* 109.173.76.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DBBF630 /* 109.187.246.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DBC49D8 /* 109.188.73.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DBD4EDF /* 109.189.78.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DBD9D3F /* 109.189.157.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DBE1822 /* 109.190.24.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DBE4295 /* 109.190.66.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DBEB62C /* 109.190.182.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC01159 /* 109.192.17.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC0DDFB /* 109.192.221.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC13134 /* 109.193.49.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC146DB /* 109.193.70.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC26E91 /* 109.194.110.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC2E7B4 /* 109.194.231.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC373CA /* 109.195.115.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC393F8 /* 109.195.147.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC41236 /* 109.196.18.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC5C1A0 /* 109.197.193.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC98564 /* 109.201.133.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DC99408 /* 109.201.148.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DE26195 /* 109.226.97.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DE48298 /* 109.228.130.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DE6E7A5 /* 109.230.231.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DE6EC59 /* 109.230.236.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DE97FE9 /* 109.233.127.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DEA24C4 /* 109.234.36.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DEC5809 /* 109.236.88.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DFE5606 /* 109.254.86.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DFF006B /* 109.255.0.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6DFFBD87 /* 109.255.189.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6E042F8B /* 110.4.47.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6E43583F /* 110.67.88.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6E93A5CA /* 110.147.165.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6F59788D /* 111.89.120.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6F59A849 /* 111.89.168.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6F5A8C51 /* 111.90.140.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6F5A92DC /* 111.90.146.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x6F5A94B2 /* 111.90.148.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x704E06F1 /* 112.78.6.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x71141F2D /* 113.20.31.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x71921957 /* 113.146.25.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7197112D /* 113.151.17.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x71C5335F /* 113.197.51.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x72B688D9 /* 114.182.136.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x73463970 /* 115.70.57.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x734D68ED /* 115.77.104.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7354E85B /* 115.84.232.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x737C70EB /* 115.124.112.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x73927FE0 /* 115.146.127.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x73A36FBA /* 115.163.111.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x73BAF33C /* 115.186.243.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x73BBF6B8 /* 115.187.246.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7464807E /* 116.100.128.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x751263F9 /* 117.18.99.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x75C9F002 /* 117.201.240.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x76094F93 /* 118.9.79.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7612FD23 /* 118.18.253.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x767F6C88 /* 118.127.108.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x76A34A9D /* 118.163.74.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x76D097C0 /* 118.208.151.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x76D0DAD3 /* 118.208.218.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x773B7F68 /* 119.59.127.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x77EBF988 /* 119.235.249.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x781DD92E /* 120.29.217.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7838AA63 /* 120.56.170.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x792CD234 /* 121.44.210.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x792DBF12 /* 121.45.191.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7936AF32 /* 121.54.175.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x794953C0 /* 121.73.83.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7963E40E /* 121.99.228.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7976CB7A /* 121.118.203.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x797971EA /* 121.121.113.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x797FFA9C /* 121.127.250.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7A3B7991 /* 122.59.121.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7B1E8847 /* 123.30.136.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7C521DB5 /* 124.82.29.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7C6D01CF /* 124.109.1.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CA8D5E7 /* 124.168.213.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CD9F316 /* 124.217.243.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CD9FA48 /* 124.217.250.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CD9FE37 /* 124.217.254.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CD9FE46 /* 124.217.254.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CD9FE63 /* 124.217.254.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CD9FEB1 /* 124.217.254.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7CF8F4AE /* 124.248.244.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7D01E599 /* 125.1.229.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7DD19718 /* 125.209.151.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7DD4D9C5 /* 125.212.217.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7DD4DC3C /* 125.212.220.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7DD4F1B6 /* 125.212.241.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7DEEFF4B /* 125.238.255.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x7E460792 /* 126.70.7.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x800CB13B /* 128.12.177.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x801E4FCA /* 128.30.79.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x801F0022 /* 128.31.0.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8027081D /* 128.39.8.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80348069 /* 128.52.128.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8034B2E9 /* 128.52.178.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8034B3C0 /* 128.52.179.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8044C9FA /* 128.68.201.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8048D327 /* 128.72.211.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x807F2821 /* 128.127.40.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x807F2F40 /* 128.127.47.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x807F6A31 /* 128.127.106.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x807F6F19 /* 128.127.111.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8082CC5B /* 128.130.204.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8099927D /* 128.153.146.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7227A /* 128.199.34.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C72305 /* 128.199.35.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C723A2 /* 128.199.35.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7250C /* 128.199.37.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C729EE /* 128.199.41.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C72FA0 /* 128.199.47.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C72FEB /* 128.199.47.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C73725 /* 128.199.55.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C737CF /* 128.199.55.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C73B14 /* 128.199.59.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C745EA /* 128.199.69.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C75130 /* 128.199.81.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C755A5 /* 128.199.85.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C77A68 /* 128.199.122.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C783A8 /* 128.199.131.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C78407 /* 128.199.132.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7859A /* 128.199.133.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C78A4A /* 128.199.138.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C78BE0 /* 128.199.139.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C79C12 /* 128.199.156.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7A36C /* 128.199.163.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7AAF6 /* 128.199.170.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7B364 /* 128.199.179.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7C0E6 /* 128.199.192.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7C270 /* 128.199.194.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7C76B /* 128.199.199.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7C778 /* 128.199.199.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7D230 /* 128.199.210.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7DD23 /* 128.199.221.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7E058 /* 128.199.224.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7E42A /* 128.199.228.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7E43D /* 128.199.228.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7EA03 /* 128.199.234.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7EAFC /* 128.199.234.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7EC3C /* 128.199.236.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7F0C1 /* 128.199.240.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7F24B /* 128.199.242.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7F4CE /* 128.199.244.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7FB59 /* 128.199.251.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80C7FCC5 /* 128.199.252.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80D002E9 /* 128.208.2.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x80E81239 /* 128.232.18.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x810A73D9 /* 129.10.115.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x810A73DA /* 129.10.115.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x810A73DB /* 129.10.115.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x810A73DC /* 129.10.115.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8164226A /* 129.100.34.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x81E8E70A /* 129.232.231.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x81F2DB33 /* 129.242.219.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x823FAD7E /* 130.63.173.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82950E1F /* 130.149.14.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8295C80A /* 130.149.200.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B417E6 /* 130.180.23.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B41EFE /* 130.180.30.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B43F96 /* 130.180.63.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B448B2 /* 130.180.72.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B46F5E /* 130.180.111.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B96832 /* 130.185.104.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B9FA4C /* 130.185.250.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B9FA4D /* 130.185.250.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82B9FAAB /* 130.185.250.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82C10FBA /* 130.193.15.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82CCA103 /* 130.204.161.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E1FE67 /* 130.225.254.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671E4 /* 130.230.113.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671E5 /* 130.230.113.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671E6 /* 130.230.113.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671E7 /* 130.230.113.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671E8 /* 130.230.113.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671E9 /* 130.230.113.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671EA /* 130.230.113.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671EB /* 130.230.113.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671EC /* 130.230.113.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82E671ED /* 130.230.113.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82FF0ABF /* 130.255.10.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x82FF48A4 /* 130.255.72.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x83828E62 /* 131.130.142.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x839B477C /* 131.155.71.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x83BC28BC /* 131.188.40.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x83BC28BD /* 131.188.40.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x83D7ACD6 /* 131.215.172.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x83FF05EF /* 131.255.5.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x83FF073A /* 131.255.7.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x84D83602 /* 132.216.54.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x84E69651 /* 132.230.150.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8526CAC6 /* 133.38.202.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x85827CB9 /* 133.130.124.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x85E8E634 /* 133.232.230.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x85F29226 /* 133.242.146.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x85F2924E /* 133.242.146.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x860304E1 /* 134.3.4.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x86035FCB /* 134.3.95.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8613B16D /* 134.19.177.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x86229380 /* 134.34.147.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8631E95E /* 134.49.233.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x863A2C06 /* 134.58.44.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x863A2C3B /* 134.58.44.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x865B4E8F /* 134.91.78.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x866370A8 /* 134.99.112.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8666167A /* 134.102.22.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8666C865 /* 134.102.200.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x86770302 /* 134.119.3.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x867703A4 /* 134.119.3.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x86770923 /* 134.119.9.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x86771AC1 /* 134.119.26.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x867720D0 /* 134.119.32.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x867720F7 /* 134.119.32.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x86772487 /* 134.119.36.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8682B52B /* 134.130.181.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8682B531 /* 134.130.181.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8682B5D4 /* 134.130.181.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x87177229 /* 135.23.114.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8820EE8D /* 136.32.238.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x883E0ED6 /* 136.62.14.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x883E12DD /* 136.62.18.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x883E1876 /* 136.62.24.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88A8C999 /* 136.168.201.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3019C /* 136.243.1.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F346C7 /* 136.243.70.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3620C /* 136.243.98.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F36686 /* 136.243.102.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F36B04 /* 136.243.107.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3723E /* 136.243.114.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F39552 /* 136.243.149.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3AE61 /* 136.243.174.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3B094 /* 136.243.176.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3B185 /* 136.243.177.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3BBA5 /* 136.243.187.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3D134 /* 136.243.209.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x88F3D689 /* 136.243.214.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894A15AD /* 137.74.21.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894A19AF /* 137.74.25.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894A284D /* 137.74.40.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894A74A8 /* 137.74.116.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894A74D6 /* 137.74.116.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894A7534 /* 137.74.117.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AA191 /* 137.74.161.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AA4D5 /* 137.74.164.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AA760 /* 137.74.167.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AA7A1 /* 137.74.167.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AA7E0 /* 137.74.167.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AA9F1 /* 137.74.169.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AAD8F /* 137.74.173.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x894AE084 /* 137.74.224.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x89656D65 /* 137.101.109.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x898708E9 /* 137.135.8.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x89CD7C23 /* 137.205.124.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x89E26F7B /* 137.226.111.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A440004 /* 138.68.0.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A440077 /* 138.68.0.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A44060F /* 138.68.6.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A44082B /* 138.68.8.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A440AF0 /* 138.68.10.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A440DAB /* 138.68.13.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A440E2A /* 138.68.14.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A440FBF /* 138.68.15.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A4425B2 /* 138.68.37.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A443215 /* 138.68.50.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A444545 /* 138.68.69.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A44505B /* 138.68.80.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A44506C /* 138.68.80.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A446159 /* 138.68.97.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A446BA3 /* 138.68.107.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A446D32 /* 138.68.109.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A44815D /* 138.68.129.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A44829E /* 138.68.130.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A4486F9 /* 138.68.134.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A448CD7 /* 138.68.140.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A448E83 /* 138.68.142.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A4496A8 /* 138.68.150.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A449F8E /* 138.68.159.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A44E89B /* 138.68.232.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A4B48B1 /* 138.75.72.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8A75942D /* 138.117.148.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5044D /* 138.197.4.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC50EE2 /* 138.197.14.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC53B16 /* 138.197.59.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC54C0C /* 138.197.76.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC56030 /* 138.197.96.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC57DFC /* 138.197.125.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC58551 /* 138.197.133.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC585FF /* 138.197.133.255/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC58893 /* 138.197.136.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC58B4F /* 138.197.139.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC58F84 /* 138.197.143.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5C2E6 /* 138.197.194.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5C432 /* 138.197.196.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5CA23 /* 138.197.202.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5CD32 /* 138.197.205.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5CFB0 /* 138.197.207.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5CFB1 /* 138.197.207.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5CFF3 /* 138.197.207.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5D1FE /* 138.197.209.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5D60B /* 138.197.214.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC5DFFA /* 138.197.223.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9034B /* 138.201.3.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9396D /* 138.201.57.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC93ACE /* 138.201.58.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC94B06 /* 138.201.75.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC953AB /* 138.201.83.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC95BD2 /* 138.201.91.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC95C74 /* 138.201.92.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC95CB7 /* 138.201.92.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC95EF9 /* 138.201.94.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC95F7D /* 138.201.95.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC96AD1 /* 138.201.106.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC975A7 /* 138.201.117.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC976FE /* 138.201.118.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC98411 /* 138.201.132.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9876C /* 138.201.135.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC98FBA /* 138.201.143.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC99514 /* 138.201.149.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC99515 /* 138.201.149.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC99AD1 /* 138.201.154.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC99E2C /* 138.201.158.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9A90C /* 138.201.169.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9C6A4 /* 138.201.198.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9D3EA /* 138.201.211.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9D3EB /* 138.201.211.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9F557 /* 138.201.245.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9F702 /* 138.201.247.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9F712 /* 138.201.247.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8AC9FFF5 /* 138.201.255.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8ACCAB67 /* 138.204.171.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8ADB2B8D /* 138.219.43.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B121923 /* 139.18.25.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B0006 /* 139.59.0.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B0025 /* 139.59.0.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B005E /* 139.59.0.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B0282 /* 139.59.2.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B02BA /* 139.59.2.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B077C /* 139.59.7.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B0886 /* 139.59.8.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B0B21 /* 139.59.11.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B0DD9 /* 139.59.13.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B1005 /* 139.59.16.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B1453 /* 139.59.20.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B16D5 /* 139.59.22.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B1AA7 /* 139.59.26.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B1D2E /* 139.59.29.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B1F4C /* 139.59.31.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B1FE3 /* 139.59.31.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B20BE /* 139.59.32.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B21AC /* 139.59.33.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B22D1 /* 139.59.34.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2439 /* 139.59.36.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2495 /* 139.59.36.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2498 /* 139.59.36.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2565 /* 139.59.37.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2735 /* 139.59.39.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B29C5 /* 139.59.41.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2ADF /* 139.59.42.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2BBA /* 139.59.43.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2C60 /* 139.59.44.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2C79 /* 139.59.44.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2E46 /* 139.59.46.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B2EAB /* 139.59.46.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B81A3 /* 139.59.129.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B9BAE /* 139.59.155.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3B9ED2 /* 139.59.158.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3BAC5D /* 139.59.172.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B3BEBAC /* 139.59.235.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8B8CB597 /* 139.140.181.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA20728 /* 139.162.7.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA20991 /* 139.162.9.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA20A48 /* 139.162.10.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2100D /* 139.162.16.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA213E9 /* 139.162.19.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA21C17 /* 139.162.28.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA21C1F /* 139.162.28.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA22C80 /* 139.162.44.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA239A7 /* 139.162.57.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA23D2C /* 139.162.61.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA23DB1 /* 139.162.61.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA24E3D /* 139.162.78.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA254B8 /* 139.162.84.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA26052 /* 139.162.96.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2706F /* 139.162.112.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA28E1B /* 139.162.142.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA28E78 /* 139.162.142.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA29085 /* 139.162.144.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA29424 /* 139.162.148.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA29610 /* 139.162.150.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA29756 /* 139.162.151.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2A543 /* 139.162.165.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2B513 /* 139.162.181.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2B978 /* 139.162.185.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2BAB3 /* 139.162.186.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2BFF3 /* 139.162.191.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2D9DB /* 139.162.217.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2E2F5 /* 139.162.226.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2E81C /* 139.162.232.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2F145 /* 139.162.241.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2F578 /* 139.162.245.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8BA2F80D /* 139.162.248.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8C71D049 /* 140.113.208.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8C71D05B /* 140.113.208.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8C71EB97 /* 140.113.235.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8C73BDA4 /* 140.115.189.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8C73BDBD /* 140.115.189.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8C8A90AA /* 140.138.144.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8CC0DA8B /* 140.192.218.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D00920E /* 141.0.146.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D142143 /* 141.20.33.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D142144 /* 141.20.33.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D146719 /* 141.20.103.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D160A39 /* 141.22.10.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D337D10 /* 141.51.125.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D369FB8 /* 141.54.159.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D45CD79 /* 141.69.205.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D467DE8 /* 141.70.125.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D69433A /* 141.105.67.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8D8A8DD0 /* 141.138.141.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DAA0235 /* 141.170.2.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFF0B78 /* 141.255.11.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFFA1A6 /* 141.255.161.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFFA1A7 /* 141.255.161.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFFA566 /* 141.255.165.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFFA68E /* 141.255.166.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFFA696 /* 141.255.166.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFFA6BD /* 141.255.166.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8DFFBDA1 /* 141.255.189.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8E0420C4 /* 142.4.32.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8E04D3BD /* 142.4.211.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8E04D480 /* 142.4.212.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8E04D6BB /* 142.4.214.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8E36BAB2 /* 142.54.186.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8E36BEFA /* 142.54.190.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8F6A3C46 /* 143.106.60.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8F6A3C56 /* 143.106.60.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8FB03433 /* 143.176.52.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8FF8394B /* 143.248.57.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x8FF8DF6F /* 143.248.223.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C06C7 /* 144.76.6.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C0B64 /* 144.76.11.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C0E91 /* 144.76.14.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C1AAF /* 144.76.26.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C1EA7 /* 144.76.30.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C1FCA /* 144.76.31.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C25F2 /* 144.76.37.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C2879 /* 144.76.40.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C2AEF /* 144.76.42.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C2D4A /* 144.76.45.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C3225 /* 144.76.50.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C357D /* 144.76.53.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C3D28 /* 144.76.61.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C4042 /* 144.76.64.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C438C /* 144.76.67.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C4629 /* 144.76.70.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C498C /* 144.76.73.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C5044 /* 144.76.80.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C51D7 /* 144.76.81.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C5ACD /* 144.76.90.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C5CB0 /* 144.76.92.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C6007 /* 144.76.96.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C6975 /* 144.76.105.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C6D8A /* 144.76.109.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C7055 /* 144.76.112.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C75A9 /* 144.76.117.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C843C /* 144.76.132.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904C9E88 /* 144.76.158.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904CA35D /* 144.76.163.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904CACBB /* 144.76.172.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904CAFCD /* 144.76.175.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x904CFDE5 /* 144.76.253.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90880513 /* 144.136.5.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D90FA4 /* 144.217.15.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D90FB3 /* 144.217.15.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D9388C /* 144.217.56.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D9388D /* 144.217.56.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D93CD3 /* 144.217.60.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D93CEF /* 144.217.60.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D9574E /* 144.217.87.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D95A8A /* 144.217.90.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D9632E /* 144.217.99.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D9A177 /* 144.217.161.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x90D9A29E /* 144.217.162.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x918102BC /* 145.129.2.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x91842AEA /* 145.132.42.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x91852984 /* 145.133.41.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x91FFF332 /* 145.255.243.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9200207A /* 146.0.32.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92002084 /* 146.0.32.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92002090 /* 146.0.32.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92002A2B /* 146.0.42.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92002B79 /* 146.0.43.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92002B7E /* 146.0.43.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92004D32 /* 146.0.77.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92004FF3 /* 146.0.79.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x923449B4 /* 146.52.73.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92345305 /* 146.52.83.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x923496A2 /* 146.52.150.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9234CF31 /* 146.52.207.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92732C7C /* 146.115.44.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9273918F /* 146.115.145.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9273A25B /* 146.115.162.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B98269 /* 146.185.130.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B983EF /* 146.185.131.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B98823 /* 146.185.136.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B98DA3 /* 146.185.141.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B99170 /* 146.185.145.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B996DB /* 146.185.150.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B99BDA /* 146.185.155.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B99D3D /* 146.185.157.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9A01E /* 146.185.160.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9A32C /* 146.185.163.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9A374 /* 146.185.163.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9AA23 /* 146.185.170.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9B024 /* 146.185.176.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9B167 /* 146.185.177.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9BDC5 /* 146.185.189.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9BDCB /* 146.185.189.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9FB28 /* 146.185.251.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92B9FD65 /* 146.185.253.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x92FF39E4 /* 146.255.57.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9353AF2F /* 147.83.175.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9393BD78 /* 147.147.189.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x93AFBB8F /* 147.175.187.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x93AFBBB4 /* 147.175.187.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x93FB2ADD /* 147.251.42.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB2AA4 /* 148.251.42.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB31B4 /* 148.251.49.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB324A /* 148.251.50.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB37F6 /* 148.251.55.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB4464 /* 148.251.68.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB5884 /* 148.251.88.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB71E6 /* 148.251.113.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB809C /* 148.251.128.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB8854 /* 148.251.136.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FB97F0 /* 148.251.151.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBA8E2 /* 148.251.168.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBB019 /* 148.251.176.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBB652 /* 148.251.182.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBBEE5 /* 148.251.190.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBCE86 /* 148.251.206.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBD635 /* 148.251.214.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBDDA3 /* 148.251.221.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBE30E /* 148.251.227.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBEEFD /* 148.251.238.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBF597 /* 148.251.245.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBFEE5 /* 148.251.254.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x94FBFF5C /* 148.251.255.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9509001B /* 149.9.0.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x953801CC /* 149.56.1.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95380C4E /* 149.56.12.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95381954 /* 149.56.25.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95382DC8 /* 149.56.45.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x953860A5 /* 149.56.96.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95386319 /* 149.56.99.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95386494 /* 149.56.100.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95386776 /* 149.56.103.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95386CC4 /* 149.56.108.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95386EFA /* 149.56.110.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x953884A8 /* 149.56.132.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538B938 /* 149.56.185.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538C943 /* 149.56.201.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538C9A8 /* 149.56.201.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538CC7E /* 149.56.204.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538CCDA /* 149.56.204.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538DFF0 /* 149.56.223.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538DFF2 /* 149.56.223.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538DFF4 /* 149.56.223.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538E510 /* 149.56.229.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538E511 /* 149.56.229.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9538E98E /* 149.56.233.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x955675C2 /* 149.86.117.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x955B5261 /* 149.91.82.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x959A9879 /* 149.154.152.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x959A9D50 /* 149.154.157.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x959A9E7A /* 149.154.158.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x959A9EE4 /* 149.154.158.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x959A9F57 /* 149.154.159.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x959A9FAC /* 149.154.159.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95AC95AA /* 149.172.149.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA026A /* 149.202.2.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA186A /* 149.202.24.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA3157 /* 149.202.49.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA39D6 /* 149.202.57.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA3A29 /* 149.202.58.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA3F64 /* 149.202.63.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA3FD6 /* 149.202.63.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA62A0 /* 149.202.98.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CA62A1 /* 149.202.98.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CAA045 /* 149.202.160.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CAB5D6 /* 149.202.181.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CABE0E /* 149.202.190.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CAC0CB /* 149.202.192.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CADC50 /* 149.202.220.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CAEEC6 /* 149.202.238.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95CAEECC /* 149.202.238.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95D2A4E4 /* 149.210.164.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95D2DA29 /* 149.210.218.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95D2DD30 /* 149.210.221.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95D2E29B /* 149.210.226.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x95FF255A /* 149.255.37.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x965F8736 /* 150.95.135.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x965F8A2A /* 150.95.138.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9665F363 /* 150.101.243.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x966B9624 /* 150.107.150.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x966B9665 /* 150.107.150.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x966B9666 /* 150.107.150.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x969202F5 /* 150.146.2.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9701B6D9 /* 151.1.182.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x971B6AE0 /* 151.27.106.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x972DDDDB /* 151.45.221.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97378BF5 /* 151.55.139.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97437350 /* 151.67.115.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97502591 /* 151.80.37.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97502643 /* 151.80.38.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97502848 /* 151.80.40.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97502A67 /* 151.80.42.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97502D31 /* 151.80.45.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9750388D /* 151.80.56.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97503B90 /* 151.80.59.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97506DA8 /* 151.80.109.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x975073B4 /* 151.80.115.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9750800C /* 151.80.128.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97509399 /* 151.80.147.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9750EE98 /* 151.80.238.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97E06098 /* 151.224.96.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97E46D46 /* 151.228.109.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97EC066E /* 151.236.6.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97EC06C2 /* 151.236.6.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97EC0B72 /* 151.236.11.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97EC0C7E /* 151.236.12.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97ECDA43 /* 151.236.218.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97ECDD2C /* 151.236.221.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97ECDED9 /* 151.236.222.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97EDBE32 /* 151.237.190.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x97EDE583 /* 151.237.229.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x995C7EEA /* 153.92.126.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x995C7F69 /* 153.92.127.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x995C7FCE /* 153.92.127.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x995C7FEF /* 153.92.127.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x99782A89 /* 153.120.42.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9978ABB7 /* 153.120.171.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x997925A6 /* 153.121.37.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x99792C1E /* 153.121.44.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x997E9E41 /* 153.126.158.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x997EC45F /* 153.126.196.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x997FC77C /* 153.127.199.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x999562FB /* 153.149.98.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x99F80697 /* 153.248.6.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9A23AFE1 /* 154.35.175.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9A31D448 /* 154.49.212.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9A4699AF /* 154.70.153.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9A7F3C5C /* 154.127.60.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9A7F3C9A /* 154.127.60.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9A7F3D86 /* 154.127.61.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9A7F3DF9 /* 154.127.61.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9B0409EA /* 155.4.9.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9B0467D6 /* 155.4.103.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9B04B45D /* 155.4.180.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9B04D4B5 /* 155.4.212.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9B5EB5B3 /* 155.94.181.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9B620506 /* 155.98.5.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9B8526E2 /* 155.133.38.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9BFE31B2 /* 155.254.49.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA02 /* 158.58.170.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA1B /* 158.58.170.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA3F /* 158.58.170.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA42 /* 158.58.170.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA43 /* 158.58.170.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA63 /* 158.58.170.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA6F /* 158.58.170.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA8F /* 158.58.170.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA95 /* 158.58.170.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA9D /* 158.58.170.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAA9F /* 158.58.170.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAAB7 /* 158.58.170.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAAC3 /* 158.58.170.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAADC /* 158.58.170.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAB8F /* 158.58.171.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAB90 /* 158.58.171.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E3AAD4E /* 158.58.173.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E452483 /* 158.69.36.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E452498 /* 158.69.36.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E4525D5 /* 158.69.37.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45304D /* 158.69.48.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E455C7F /* 158.69.92.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E4566D0 /* 158.69.102.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E457723 /* 158.69.119.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45C1F3 /* 158.69.193.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45CC24 /* 158.69.204.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45CD5C /* 158.69.205.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45CDCC /* 158.69.205.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45CDD7 /* 158.69.205.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45CDF7 /* 158.69.205.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45CE9A /* 158.69.206.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45CFD8 /* 158.69.207.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45D59A /* 158.69.213.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45D812 /* 158.69.216.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45D922 /* 158.69.217.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E45F750 /* 158.69.247.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9E8200F2 /* 158.130.0.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EC19905 /* 158.193.153.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EC19906 /* 158.193.153.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF04F1 /* 158.255.4.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF0575 /* 158.255.5.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF05B4 /* 158.255.5.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF05B5 /* 158.255.5.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF05CE /* 158.255.5.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF05CF /* 158.255.5.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF06F2 /* 158.255.6.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFF073D /* 158.255.7.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFFD4B2 /* 158.255.212.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9EFFD729 /* 158.255.215.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9F7A02D1 /* 159.122.2.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9F94BA90 /* 159.148.186.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9F94BAA2 /* 159.148.186.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9F94BAC0 /* 159.148.186.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9F94BAC4 /* 159.148.186.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9F94BAC7 /* 159.148.186.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9F94BAEC /* 159.148.186.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB0156 /* 159.203.1.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB03E0 /* 159.203.3.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB0551 /* 159.203.5.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB0F64 /* 159.203.15.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB0F94 /* 159.203.15.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB1017 /* 159.203.16.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB10E9 /* 159.203.16.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB1167 /* 159.203.17.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB1263 /* 159.203.18.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB1633 /* 159.203.22.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB1B05 /* 159.203.27.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB1B6F /* 159.203.27.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB1DF0 /* 159.203.29.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB2095 /* 159.203.32.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB2136 /* 159.203.33.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB26FA /* 159.203.38.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB2977 /* 159.203.41.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB2985 /* 159.203.41.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB2A6B /* 159.203.42.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB2EAE /* 159.203.46.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB2FA6 /* 159.203.47.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB5558 /* 159.203.85.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCB678A /* 159.203.103.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBABFE /* 159.203.171.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBAD26 /* 159.203.173.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBC148 /* 159.203.193.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBC1AF /* 159.203.193.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBDB65 /* 159.203.219.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBE019 /* 159.203.224.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBEAF4 /* 159.203.234.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBFBEC /* 159.203.251.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0x9FCBFDB7 /* 159.203.253.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA135A068 /* 161.53.160.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA161C332 /* 161.97.195.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA161C71E /* 161.97.199.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2C1E616 /* 162.193.230.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DAEF7D /* 162.218.239.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DB0739 /* 162.219.7.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DCA5B9 /* 162.220.165.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DCDA6D /* 162.220.218.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DCF6E6 /* 162.220.246.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DDC939 /* 162.221.201.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DDCAE6 /* 162.221.202.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2DE3486 /* 162.222.52.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F308A1 /* 162.243.8.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F32430 /* 162.243.36.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F337CB /* 162.243.55.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F33C60 /* 162.243.60.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F3411C /* 162.243.65.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F348C6 /* 162.243.72.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F364E1 /* 162.243.100.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F3733B /* 162.243.115.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F386BC /* 162.243.134.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F3969C /* 162.243.150.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F396E5 /* 162.243.150.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F3A689 /* 162.243.166.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F3C376 /* 162.243.195.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F419D6 /* 162.244.25.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F41A09 /* 162.244.26.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F41A4C /* 162.244.26.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F517B0 /* 162.245.23.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F74807 /* 162.247.72.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F7481B /* 162.247.72.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F748C7 /* 162.247.72.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F748C8 /* 162.247.72.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F748C9 /* 162.247.72.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F748CA /* 162.247.72.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F748D5 /* 162.247.72.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F748D8 /* 162.247.72.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F748D9 /* 162.247.72.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F7494A /* 162.247.73.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F749C3 /* 162.247.73.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F749CC /* 162.247.73.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F749CE /* 162.247.73.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F74B76 /* 162.247.75.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F80A84 /* 162.248.10.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F80BB0 /* 162.248.11.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2F8A50E /* 162.248.165.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2FCCC3E /* 162.252.204.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2FCF250 /* 162.252.242.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA2FCF314 /* 162.252.243.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA31611D3 /* 163.22.17.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA32C709C /* 163.44.112.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA32C70E6 /* 163.44.112.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA32C951F /* 163.44.149.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA39EA814 /* 163.158.168.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA39EB313 /* 163.158.179.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC0826 /* 163.172.8.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC0AD0 /* 163.172.10.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC0DA5 /* 163.172.13.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC0EDD /* 163.172.14.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC1560 /* 163.172.21.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC1976 /* 163.172.25.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC1B27 /* 163.172.27.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC1B3E /* 163.172.27.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC1D14 /* 163.172.29.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC1D15 /* 163.172.29.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC23D3 /* 163.172.35.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC23F7 /* 163.172.35.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC23F9 /* 163.172.35.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC2421 /* 163.172.36.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC249C /* 163.172.36.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC2AEF /* 163.172.42.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC2D1E /* 163.172.45.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC38F8 /* 163.172.56.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC3D1C /* 163.172.61.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC43B4 /* 163.172.67.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC5203 /* 163.172.82.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC527C /* 163.172.82.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC545F /* 163.172.84.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC59E3 /* 163.172.89.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC5A80 /* 163.172.90.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC6B92 /* 163.172.107.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC7316 /* 163.172.115.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8097 /* 163.172.128.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC811D /* 163.172.129.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8132 /* 163.172.129.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8143 /* 163.172.129.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8251 /* 163.172.130.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8358 /* 163.172.131.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC83A4 /* 163.172.131.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC83C0 /* 163.172.131.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC84B2 /* 163.172.132.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8536 /* 163.172.133.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8627 /* 163.172.134.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC86EE /* 163.172.134.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC87AC /* 163.172.135.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8865 /* 163.172.136.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8904 /* 163.172.137.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC898D /* 163.172.137.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8A16 /* 163.172.138.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8B68 /* 163.172.139.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8B6F /* 163.172.139.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8B86 /* 163.172.139.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8B91 /* 163.172.139.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8D0A /* 163.172.141.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8D21 /* 163.172.141.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8E0F /* 163.172.142.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC8E5C /* 163.172.142.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC90EC /* 163.172.144.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC915B /* 163.172.145.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC92CC /* 163.172.146.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC92E8 /* 163.172.146.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC957A /* 163.172.149.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC959B /* 163.172.149.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC972F /* 163.172.151.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC97AE /* 163.172.151.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC98E7 /* 163.172.152.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC98ED /* 163.172.152.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC990C /* 163.172.153.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC9BB5 /* 163.172.155.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC9C4C /* 163.172.156.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC9C89 /* 163.172.156.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC9DD5 /* 163.172.157.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC9F1B /* 163.172.159.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3AC9FE7 /* 163.172.159.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA0B6 /* 163.172.160.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA0EF /* 163.172.160.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA287 /* 163.172.162.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA2B6 /* 163.172.162.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA506 /* 163.172.165.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA5CB /* 163.172.165.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA601 /* 163.172.166.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA603 /* 163.172.166.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACA71C /* 163.172.167.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACAA17 /* 163.172.170.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACAA34 /* 163.172.170.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACAAD4 /* 163.172.170.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACAED1 /* 163.172.174.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACAFAE /* 163.172.175.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB0A7 /* 163.172.176.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB2B6 /* 163.172.178.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB5A2 /* 163.172.181.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB5F0 /* 163.172.181.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB774 /* 163.172.183.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB7A1 /* 163.172.183.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB7DC /* 163.172.183.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACB984 /* 163.172.185.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACBAC8 /* 163.172.186.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACBB98 /* 163.172.187.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACBD64 /* 163.172.189.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACBE22 /* 163.172.190.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACBE6E /* 163.172.190.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACC235 /* 163.172.194.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACC93E /* 163.172.201.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD1A1 /* 163.172.209.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD1A2 /* 163.172.209.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD1D6 /* 163.172.209.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD1D8 /* 163.172.209.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD5C9 /* 163.172.213.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD666 /* 163.172.214.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD73C /* 163.172.215.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD74E /* 163.172.215.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD8C3 /* 163.172.216.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD8CA /* 163.172.216.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD932 /* 163.172.217.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACD999 /* 163.172.217.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACDDD1 /* 163.172.221.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACDF52 /* 163.172.223.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACDF84 /* 163.172.223.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACDFA5 /* 163.172.223.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACDFC8 /* 163.172.223.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACDFD7 /* 163.172.223.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA3ACE4BF /* 163.172.228.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA43A5114 /* 164.58.81.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA44601C1 /* 164.70.1.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA44D85DC /* 164.77.133.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA48414D1 /* 164.132.20.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA4842DF0 /* 164.132.45.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA48431CD /* 164.132.49.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA484335B /* 164.132.51.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA4844DAF /* 164.132.77.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA48461EA /* 164.132.97.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA4846A62 /* 164.132.106.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA4846B6C /* 164.132.107.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA48498B8 /* 164.132.152.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA484C426 /* 164.132.196.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA484D183 /* 164.132.209.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA484D464 /* 164.132.212.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA484E1F8 /* 164.132.225.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA484E622 /* 164.132.230.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA484F9F4 /* 164.132.249.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA4D774C2 /* 164.215.116.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA5E700F2 /* 165.231.0.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA5FF3BC4 /* 165.255.59.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA5FFD8F5 /* 165.255.216.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA6460F0E /* 166.70.15.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA6465E6A /* 166.70.94.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA646CF02 /* 166.70.207.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA64E6DCB /* 166.78.109.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA64E770D /* 166.78.119.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA65215C8 /* 166.82.21.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA6540737 /* 166.84.7.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA73F77A5 /* 167.63.119.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA758236C /* 167.88.35.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA75828AB /* 167.88.40.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA75829C2 /* 167.88.41.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA75871BB /* 167.88.113.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA77203A6 /* 167.114.3.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA77207A6 /* 167.114.7.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7722102 /* 167.114.33.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7722296 /* 167.114.34.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772231C /* 167.114.35.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7722366 /* 167.114.35.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772236B /* 167.114.35.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772423D /* 167.114.66.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7724304 /* 167.114.67.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA77247BD /* 167.114.71.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7726024 /* 167.114.96.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7726713 /* 167.114.103.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7727130 /* 167.114.113.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7727186 /* 167.114.113.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7729864 /* 167.114.152.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7729BF9 /* 167.114.155.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772AB04 /* 167.114.171.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772ACDB /* 167.114.172.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772DB3D /* 167.114.219.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772E668 /* 167.114.230.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772ED8C /* 167.114.237.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA772F566 /* 167.114.245.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7A0B988 /* 167.160.185.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA7A0B9CA /* 167.160.185.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA896FB0F /* 168.150.251.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA8EB431E /* 168.235.67.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA8EB454F /* 168.235.69.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA8EB5AA5 /* 168.235.90.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA8EB5CB7 /* 168.235.92.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA8EB9214 /* 168.235.146.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA8EB99CB /* 168.235.153.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA939A547 /* 169.57.165.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xA939A55E /* 169.57.165.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAA48070A /* 170.72.7.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAA4BA257 /* 170.75.162.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAA4BA374 /* 170.75.163.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAA4EE41E /* 170.78.228.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAA8C7745 /* 170.140.119.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C109 /* 171.25.193.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C114 /* 171.25.193.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C119 /* 171.25.193.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C14D /* 171.25.193.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C14E /* 171.25.193.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C183 /* 171.25.193.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C184 /* 171.25.193.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB19C1EB /* 171.25.193.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAB4F744F /* 171.79.116.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAC56900F /* 172.86.144.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAC56940A /* 172.86.148.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAC5D333C /* 172.93.51.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAC5D3353 /* 172.93.51.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAC61672F /* 172.97.103.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAC634E22 /* 172.99.78.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAC71F0D7 /* 172.113.240.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF18C1A /* 172.241.140.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF518E4 /* 172.245.24.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF520B9 /* 172.245.32.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF520BA /* 172.245.32.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF5630A /* 172.245.99.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF57E46 /* 172.245.126.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF57E60 /* 172.245.126.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xACF5DB85 /* 172.245.219.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD03F223 /* 173.3.242.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD08D34A /* 173.8.211.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD0EADE3 /* 173.14.173.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD122918 /* 173.18.41.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD1C99C7 /* 173.28.153.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD309D99 /* 173.48.157.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD32AF5A /* 173.50.175.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD351E5B /* 173.53.30.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD429470 /* 173.66.148.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD431BE1 /* 173.67.27.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD48240E /* 173.72.36.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD494827 /* 173.73.72.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD4F3E9F /* 173.79.62.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAD4FA2DC /* 173.79.162.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADA0B4BD /* 173.160.180.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADA4CEB5 /* 173.164.206.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADA4DBFA /* 173.164.219.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADA5CF1A /* 173.165.207.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADA5F099 /* 173.165.240.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADD0D572 /* 173.208.213.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADD4C570 /* 173.212.197.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADD56C74 /* 173.213.108.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADD5719B /* 173.213.113.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADE45B1D /* 173.228.91.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADE6835A /* 173.230.131.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADE6895B /* 173.230.137.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADE6996D /* 173.230.153.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADE69A5A /* 173.230.154.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADEF4FCB /* 173.239.79.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADEF4FD2 /* 173.239.79.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFED842 /* 173.254.216.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFED843 /* 173.254.216.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFED844 /* 173.254.216.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFED845 /* 173.254.216.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFF7392 /* 173.255.115.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFCD71 /* 173.255.205.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFD745 /* 173.255.215.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFD9DE /* 173.255.217.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFDD60 /* 173.255.221.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFE28E /* 173.255.226.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFE455 /* 173.255.228.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFE486 /* 173.255.228.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFE508 /* 173.255.229.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFE5C2 /* 173.255.229.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFE77D /* 173.255.231.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFF1EB /* 173.255.241.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFF574 /* 173.255.245.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFF6A2 /* 173.255.246.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xADFFFAE7 /* 173.255.250.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE14C8EF /* 174.20.200.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE22E1D7 /* 174.34.225.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE33B292 /* 174.51.178.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE43DA0C /* 174.67.218.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE444AE7 /* 174.68.74.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE6113E6 /* 174.97.19.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE64402E /* 174.100.64.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE681A7D /* 174.104.26.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE7FE48A /* 174.127.228.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE886952 /* 174.136.105.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE886953 /* 174.136.105.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE886C52 /* 174.136.108.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xAE8DC829 /* 174.141.200.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB008995C /* 176.8.153.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00901D3 /* 176.9.1.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00904CE /* 176.9.4.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0090574 /* 176.9.5.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0091FD7 /* 176.9.31.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0092626 /* 176.9.38.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00927DA /* 176.9.39.218/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0092831 /* 176.9.40.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0092B1A /* 176.9.43.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00932F0 /* 176.9.50.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0093534 /* 176.9.53.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0093603 /* 176.9.54.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB009368E /* 176.9.54.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0094B6C /* 176.9.75.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0095425 /* 176.9.84.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB009558D /* 176.9.85.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0095AD7 /* 176.9.90.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0096386 /* 176.9.99.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0096623 /* 176.9.102.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0096708 /* 176.9.103.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0096E12 /* 176.9.110.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0096E8A /* 176.9.110.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00972B6 /* 176.9.114.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0097516 /* 176.9.117.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0097A33 /* 176.9.122.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB009859A /* 176.9.133.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0098C6C /* 176.9.140.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0098FD0 /* 176.9.143.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00993D5 /* 176.9.147.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00994B0 /* 176.9.148.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0099E76 /* 176.9.158.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB009B42F /* 176.9.180.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB009BEF0 /* 176.9.190.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB009C0AB /* 176.9.192.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB009D740 /* 176.9.215.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63C8 /* 176.10.99.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63C9 /* 176.10.99.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63CA /* 176.10.99.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63CB /* 176.10.99.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63CC /* 176.10.99.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63CD /* 176.10.99.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63CE /* 176.10.99.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63CF /* 176.10.99.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63D0 /* 176.10.99.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A63D1 /* 176.10.99.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A68F0 /* 176.10.104.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A68F3 /* 176.10.104.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A6BB4 /* 176.10.107.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00A8346 /* 176.10.131.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00AD7A4 /* 176.10.215.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00AD98E /* 176.10.217.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00AFFFD /* 176.10.255.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB00F7438 /* 176.15.116.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB014C4C1 /* 176.20.196.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB014EA66 /* 176.20.234.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0172222 /* 176.23.34.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0189B30 /* 176.24.155.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F0B7A /* 176.31.11.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F1760 /* 176.31.23.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F1C3F /* 176.31.28.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F2395 /* 176.31.35.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F2B33 /* 176.31.43.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F2D03 /* 176.31.45.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F5073 /* 176.31.80.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F6E30 /* 176.31.110.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F748C /* 176.31.116.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F7506 /* 176.31.117.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F78D7 /* 176.31.120.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F7E90 /* 176.31.126.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01F9CC7 /* 176.31.156.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01FAB0F /* 176.31.171.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01FB49D /* 176.31.180.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01FB8FF /* 176.31.184.255/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01FBF1A /* 176.31.191.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01FC87A /* 176.31.200.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB01FD79D /* 176.31.215.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0228589 /* 176.34.133.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0268C0D /* 176.38.140.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0269D26 /* 176.38.157.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB026A34D /* 176.38.163.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB026B1D0 /* 176.38.177.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB035168E /* 176.53.22.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB038EC5F /* 176.56.236.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB038EDBF /* 176.56.237.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB03A60C7 /* 176.58.96.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB03A6462 /* 176.58.100.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB03A6E42 /* 176.58.110.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB03A7122 /* 176.58.113.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB03A7816 /* 176.58.120.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB043A8D2 /* 176.67.168.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB043A9FE /* 176.67.169.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0653809 /* 176.101.56.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0653B22 /* 176.101.59.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0686AD0 /* 176.104.106.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB070E847 /* 176.112.232.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0728075 /* 176.114.128.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB072F82F /* 176.114.248.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB073FFA0 /* 176.115.255.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0746831 /* 176.116.104.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B01FD /* 176.123.1.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B0208 /* 176.123.2.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B02FA /* 176.123.2.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B02FE /* 176.123.2.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B03B4 /* 176.123.3.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B03D4 /* 176.123.3.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B04AB /* 176.123.4.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B07C5 /* 176.123.7.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B1A08 /* 176.123.26.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07B1D38 /* 176.123.29.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07EF231 /* 176.126.242.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07EFC0B /* 176.126.252.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB07EFC0C /* 176.126.252.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0804B55 /* 176.128.75.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB082E4AD /* 176.130.228.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0881911 /* 176.136.25.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0889529 /* 176.136.149.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB08F08C3 /* 176.143.8.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0952D53 /* 176.149.45.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB09E8A7A /* 176.158.138.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB09E9B78 /* 176.158.155.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB09F0253 /* 176.159.2.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB09F0B1E /* 176.159.11.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0BD77B6 /* 176.189.119.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C0B18F /* 176.192.177.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C0C197 /* 176.192.193.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C2F247 /* 176.194.242.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C68452 /* 176.198.132.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C694D1 /* 176.198.148.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C6CC54 /* 176.198.204.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C75545 /* 176.199.85.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C79952 /* 176.199.153.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0C7DA8E /* 176.199.218.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0D5958D /* 176.213.149.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0D63585 /* 176.214.53.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB0E29A3C /* 176.226.154.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB1CDB43D /* 177.205.180.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB203BAF1 /* 178.3.186.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB20441E6 /* 178.4.65.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2078D71 /* 178.7.141.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2083C01 /* 178.8.60.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB20A3039 /* 178.10.48.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB20A53E1 /* 178.10.83.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB20A6F56 /* 178.10.111.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D037 /* 178.16.208.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D038 /* 178.16.208.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D039 /* 178.16.208.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D03A /* 178.16.208.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D03B /* 178.16.208.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D03C /* 178.16.208.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D03D /* 178.16.208.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB210D03E /* 178.16.208.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AA1B /* 178.17.170.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AA4D /* 178.17.170.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AA95 /* 178.17.170.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AAA4 /* 178.17.170.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AAB3 /* 178.17.170.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AAD4 /* 178.17.170.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AB28 /* 178.17.171.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AB2B /* 178.17.171.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AB56 /* 178.17.171.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AB5D /* 178.17.171.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AD16 /* 178.17.173.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AE02 /* 178.17.174.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AE0A /* 178.17.174.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AE20 /* 178.17.174.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB211AE4F /* 178.17.174.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB21253D7 /* 178.18.83.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2136072 /* 178.19.96.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB21368E3 /* 178.19.104.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2143710 /* 178.20.55.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2143712 /* 178.20.55.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2183362 /* 178.24.51.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2189BC3 /* 178.24.155.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB219DB1E /* 178.25.219.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB21A856D /* 178.26.133.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB21B5735 /* 178.27.87.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB21B79E6 /* 178.27.121.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220225B /* 178.32.34.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2202F8C /* 178.32.47.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220355E /* 178.32.53.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220422B /* 178.32.66.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2204C5F /* 178.32.76.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2206457 /* 178.32.100.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220B560 /* 178.32.181.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220B561 /* 178.32.181.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220B562 /* 178.32.181.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220B563 /* 178.32.181.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220BD58 /* 178.32.189.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220BE0F /* 178.32.190.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220D861 /* 178.32.216.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220D892 /* 178.32.216.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220D944 /* 178.32.217.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220DC3D /* 178.32.220.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220DCBA /* 178.32.220.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220DD3A /* 178.32.221.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220DD97 /* 178.32.221.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220DDCF /* 178.32.221.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220DE15 /* 178.32.222.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB220DE7D /* 178.32.222.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2216B6D /* 178.33.107.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB221B7FB /* 178.33.183.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB221BC93 /* 178.33.188.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB22D27CC /* 178.45.39.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB22DC8CD /* 178.45.200.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB231FDD7 /* 178.49.253.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23CA523 /* 178.60.165.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E08BD /* 178.62.8.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E0999 /* 178.62.9.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E1475 /* 178.62.20.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E1624 /* 178.62.22.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E18D4 /* 178.62.24.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E2440 /* 178.62.36.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E2520 /* 178.62.37.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E2B05 /* 178.62.43.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E2E07 /* 178.62.46.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E3A2B /* 178.62.58.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E3C25 /* 178.62.60.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E4212 /* 178.62.66.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E48DC /* 178.62.72.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E4FE3 /* 178.62.79.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E5660 /* 178.62.86.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E56CE /* 178.62.86.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E586F /* 178.62.88.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E5D24 /* 178.62.93.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E5EF3 /* 178.62.94.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E64DC /* 178.62.100.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E6939 /* 178.62.105.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E6BC2 /* 178.62.107.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E6DA4 /* 178.62.109.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23E7D7D /* 178.62.125.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EADCB /* 178.62.173.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EB893 /* 178.62.184.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EBA9B /* 178.62.186.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EC131 /* 178.62.193.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EC447 /* 178.62.196.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EC513 /* 178.62.197.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EC552 /* 178.62.197.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EC636 /* 178.62.198.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EC7E2 /* 178.62.199.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EC90F /* 178.62.201.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23ECA3B /* 178.62.202.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23ECB7E /* 178.62.203.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23ECCE0 /* 178.62.204.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23ED28A /* 178.62.210.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23ED9E9 /* 178.62.217.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EDED6 /* 178.62.222.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EF4A8 /* 178.62.244.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EFBB8 /* 178.62.251.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EFC52 /* 178.62.252.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EFCEA /* 178.62.252.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23EFD06 /* 178.62.253.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F09A5 /* 178.63.9.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F1030 /* 178.63.16.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F1219 /* 178.63.18.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F190A /* 178.63.25.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F3D43 /* 178.63.61.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F41B3 /* 178.63.65.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F4E08 /* 178.63.78.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F550E /* 178.63.85.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F6122 /* 178.63.97.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F6E97 /* 178.63.110.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F749D /* 178.63.116.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23F9A5D /* 178.63.154.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23FA2D4 /* 178.63.162.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23FC671 /* 178.63.198.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB23FD133 /* 178.63.209.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB240253C /* 178.64.37.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2444089 /* 178.68.64.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB249D276 /* 178.73.210.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24A158D /* 178.74.21.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24B94CE /* 178.75.148.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24D7B29 /* 178.77.123.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24ED5D6 /* 178.78.213.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24EEAC3 /* 178.78.234.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24F86C4 /* 178.79.134.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24F88E6 /* 178.79.136.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24F8B11 /* 178.79.139.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24F90A3 /* 178.79.144.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24F9EDD /* 178.79.158.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24F9F93 /* 178.79.159.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24F9FE0 /* 178.79.159.224/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FA039 /* 178.79.160.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FA198 /* 178.79.161.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FA1B1 /* 178.79.161.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FA3A9 /* 178.79.163.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FA515 /* 178.79.165.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FAD93 /* 178.79.173.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FB194 /* 178.79.177.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB24FBCD4 /* 178.79.188.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB253BE6C /* 178.83.190.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB25C5A08 /* 178.92.90.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2844E94 /* 178.132.78.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB28C6812 /* 178.140.104.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB29BA723 /* 178.155.167.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB29CCAB2 /* 178.156.202.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A242D4 /* 178.162.66.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2C252 /* 178.162.194.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2C2D2 /* 178.162.194.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2C30C /* 178.162.195.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2C742 /* 178.162.199.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2C870 /* 178.162.200.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2C871 /* 178.162.200.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2C872 /* 178.162.200.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2CE11 /* 178.162.206.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A2CE12 /* 178.162.206.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A4DC30 /* 178.164.220.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2A4E3FF /* 178.164.227.255/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2AEB438 /* 178.174.180.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2AF8032 /* 178.175.128.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2AF8242 /* 178.175.130.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2AF83C2 /* 178.175.131.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2BFED2B /* 178.191.237.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2C1F126 /* 178.193.241.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2C29763 /* 178.194.151.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2C29935 /* 178.194.153.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2C802E5 /* 178.200.2.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2C89DAD /* 178.200.157.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2C8D57E /* 178.200.213.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2C9937D /* 178.201.147.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2CAFFA1 /* 178.202.255.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2CBDB0B /* 178.203.219.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2CE7740 /* 178.206.119.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D12EAD /* 178.209.46.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D13297 /* 178.209.50.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D13363 /* 178.209.51.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D1342F /* 178.209.52.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D13491 /* 178.209.52.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D134A2 /* 178.209.52.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D9B820 /* 178.217.184.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2D9BB27 /* 178.217.187.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2DA72AF /* 178.218.114.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2DB593B /* 178.219.89.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2EEE084 /* 178.238.224.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2EEE40C /* 178.238.228.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2EEE86E /* 178.238.232.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2EEED2C /* 178.238.237.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2F86C76 /* 178.248.108.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FBE48E /* 178.251.228.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FC1CC8 /* 178.252.28.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE0D5C /* 178.254.13.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE0D7E /* 178.254.13.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE1215 /* 178.254.18.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE1486 /* 178.254.20.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE1AF4 /* 178.254.26.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE1E56 /* 178.254.30.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE2224 /* 178.254.34.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE2755 /* 178.254.39.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE2914 /* 178.254.41.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE2C87 /* 178.254.44.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FE3765 /* 178.254.55.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB2FF94C3 /* 178.255.148.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B86CA /* 179.43.134.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B86CB /* 179.43.134.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B86CC /* 179.43.134.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B86CD /* 179.43.134.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B92E6 /* 179.43.146.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B97E2 /* 179.43.151.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B97E3 /* 179.43.151.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B97E4 /* 179.43.151.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B97E5 /* 179.43.151.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32B97E6 /* 179.43.151.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32BA0C9 /* 179.43.160.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32BA882 /* 179.43.168.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32BA8A6 /* 179.43.168.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32BA90E /* 179.43.169.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB32BBCCE /* 179.43.188.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB330F811 /* 179.48.248.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB36EB595 /* 179.110.181.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB3B337F6 /* 179.179.55.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB3B3C9A2 /* 179.179.201.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB40F9869 /* 180.15.152.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB42E910F /* 180.46.145.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB43F539C /* 180.63.83.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB4B5900D /* 180.181.144.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB52812CA /* 181.40.18.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB55FC092 /* 181.95.192.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB58B9234 /* 181.139.146.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB58F629E /* 181.143.98.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB6FD812C /* 182.253.129.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB7B53AA6 /* 183.181.58.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB838AD10 /* 184.56.173.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB844B4EE /* 184.68.180.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB85A4952 /* 184.90.73.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB8659839 /* 184.101.152.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB86990B4 /* 184.105.144.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB86990B5 /* 184.105.144.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB869DC18 /* 184.105.220.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB86A6DF4 /* 184.106.109.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB89CDDB7 /* 184.156.221.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB8A07785 /* 184.160.119.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB8A79277 /* 184.167.146.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB8AEABD3 /* 184.174.171.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB8B705CB /* 184.183.5.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9022B54 /* 185.2.43.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9022B57 /* 185.2.43.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9045C43 /* 185.4.92.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90509BC /* 185.5.9.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9061D37 /* 185.6.29.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB907FE43 /* 185.7.254.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9083F26 /* 185.8.63.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB908EC83 /* 185.8.236.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB908ED2D /* 185.8.237.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB908EDD0 /* 185.8.237.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB908EE8B /* 185.8.238.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9091353 /* 185.9.19.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB909517C /* 185.9.81.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90A445F /* 185.10.68.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90A4477 /* 185.10.68.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90A448E /* 185.10.68.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90BB443 /* 185.11.180.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90C1C74 /* 185.12.28.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90C2D4F /* 185.12.45.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90D26C5 /* 185.13.38.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90D27C5 /* 185.13.39.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90D27F9 /* 185.13.39.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90E1C6A /* 185.14.28.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90E1C9A /* 185.14.28.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90E1EEE /* 185.14.30.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90EB976 /* 185.14.185.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90EB9F0 /* 185.14.185.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90F483E /* 185.15.72.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90F4975 /* 185.15.73.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90F5E0E /* 185.15.94.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90F5E11 /* 185.15.94.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB90FF47C /* 185.15.244.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9103C53 /* 185.16.60.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB910AC9B /* 185.16.172.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB910AD54 /* 185.16.173.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB910AD56 /* 185.16.173.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB910C8B0 /* 185.16.200.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9156432 /* 185.21.100.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91564A3 /* 185.21.100.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9156532 /* 185.21.101.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB915D89D /* 185.21.216.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB915D8B7 /* 185.21.216.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB915D8BD /* 185.21.216.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB915D90D /* 185.21.217.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB915D91D /* 185.21.217.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB915D921 /* 185.21.217.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB916AD4E /* 185.22.173.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB916AD72 /* 185.22.173.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB916AD82 /* 185.22.173.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB916ADA2 /* 185.22.173.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB916AE29 /* 185.22.174.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB918E94A /* 185.24.233.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB919304C /* 185.25.48.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB919309D /* 185.25.48.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9193211 /* 185.25.50.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9193267 /* 185.25.50.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9193321 /* 185.25.51.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB919332A /* 185.25.51.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB919D8ED /* 185.25.216.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91A9C1C /* 185.26.156.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91A9C29 /* 185.26.156.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91A9C2D /* 185.26.156.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91A9C32 /* 185.26.156.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91BAF18 /* 185.27.175.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91D0884 /* 185.29.8.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91D08D3 /* 185.29.8.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91D9CE7 /* 185.29.156.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91EEE4D /* 185.30.238.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91FA166 /* 185.31.161.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91FACEA /* 185.31.172.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB91FE645 /* 185.31.230.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB920A016 /* 185.32.160.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB920DDC9 /* 185.32.221.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB920DDE4 /* 185.32.221.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB92200BC /* 185.34.0.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9222102 /* 185.34.33.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9223460 /* 185.34.52.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9238A5C /* 185.35.138.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB923CADD /* 185.35.202.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB925912C /* 185.37.145.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9260EAB /* 185.38.14.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9260ED6 /* 185.38.14.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9260ED7 /* 185.38.14.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9284C0A /* 185.40.76.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9299A82 /* 185.41.154.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB92DC035 /* 185.45.192.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB92F3E51 /* 185.47.62.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB92F3F80 /* 185.47.63.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB92FDE22 /* 185.47.222.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB932BFFA /* 185.50.191.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9358346 /* 185.53.131.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9385426 /* 185.56.84.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB938AF9A /* 185.56.175.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93A15C7 /* 185.58.21.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93C92F5 /* 185.60.146.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D8A0D /* 185.61.138.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D941D /* 185.61.148.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D9450 /* 185.61.148.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D9479 /* 185.61.148.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D948E /* 185.61.148.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D94BD /* 185.61.148.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D94C7 /* 185.61.148.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D94DD /* 185.61.148.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D94E4 /* 185.61.148.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D9574 /* 185.61.149.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D95C1 /* 185.61.149.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93D95F7 /* 185.61.149.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93EBE17 /* 185.62.190.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93FBE1C /* 185.63.190.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB93FFD82 /* 185.63.253.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB941C85D /* 185.65.200.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB941CD0A /* 185.65.205.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9426751 /* 185.66.103.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB942C80A /* 185.66.200.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB942FA8D /* 185.66.250.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB94535BC /* 185.69.53.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB948B248 /* 185.72.178.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB948F418 /* 185.72.244.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB948F425 /* 185.72.244.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB948F791 /* 185.72.247.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB94927BD /* 185.73.39.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9492C36 /* 185.73.44.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB949DC08 /* 185.73.220.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB949F0CD /* 185.73.240.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB94C916D /* 185.76.145.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB94D8123 /* 185.77.129.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB94E4328 /* 185.78.67.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB950DE69 /* 185.80.222.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB950DE9E /* 185.80.222.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB950DEA4 /* 185.80.222.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9521569 /* 185.82.21.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB952C8D0 /* 185.82.200.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB952C936 /* 185.82.201.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB952CB47 /* 185.82.203.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB952CBD1 /* 185.82.203.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB952D8E9 /* 185.82.216.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB952D90E /* 185.82.217.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB952D924 /* 185.82.217.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9564F5C /* 185.86.79.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9569496 /* 185.86.148.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9569518 /* 185.86.149.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9569555 /* 185.86.149.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB95695E6 /* 185.86.149.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB956962C /* 185.86.150.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9569766 /* 185.86.151.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB957B92D /* 185.87.185.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB957B9DD /* 185.87.185.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB957BA1B /* 185.87.186.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB95C4409 /* 185.92.68.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB95CDE34 /* 185.92.222.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB95CDED0 /* 185.92.222.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB95DB496 /* 185.93.180.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB960581D /* 185.96.88.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB960B41D /* 185.96.180.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9612012 /* 185.97.32.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9612022 /* 185.97.32.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9612024 /* 185.97.32.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645452 /* 185.100.84.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB964546C /* 185.100.84.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96454D4 /* 185.100.84.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96454FB /* 185.100.84.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB964553D /* 185.100.85.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645565 /* 185.100.85.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645584 /* 185.100.85.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645593 /* 185.100.85.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96455BE /* 185.100.85.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96455C0 /* 185.100.85.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96455CF /* 185.100.85.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96455DC /* 185.100.85.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96455F4 /* 185.100.85.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645645 /* 185.100.86.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645656 /* 185.100.86.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645664 /* 185.100.86.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645673 /* 185.100.86.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645680 /* 185.100.86.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB964569A /* 185.100.86.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96456F4 /* 185.100.86.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB964571A /* 185.100.87.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB964572B /* 185.100.87.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645752 /* 185.100.87.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9645759 /* 185.100.87.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB964578F /* 185.100.87.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96457BA /* 185.100.87.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96457C0 /* 185.100.87.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96457F1 /* 185.100.87.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB965626C /* 185.101.98.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9656B21 /* 185.101.107.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB967633C /* 185.103.99.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9687802 /* 185.104.120.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9687803 /* 185.104.120.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9687804 /* 185.104.120.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9688CAC /* 185.104.140.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB968B833 /* 185.104.184.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96BE0D0 /* 185.107.224.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96D9007 /* 185.109.144.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96D923E /* 185.109.146.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB96D9294 /* 185.109.146.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9709D7E /* 185.112.157.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9709D87 /* 185.112.157.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB970FEC3 /* 185.112.254.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB971804F /* 185.113.128.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9754B1B /* 185.117.75.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9755284 /* 185.117.82.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB975585C /* 185.117.88.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB975763B /* 185.117.118.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB975D709 /* 185.117.215.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB976FB14 /* 185.118.251.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB97893AB /* 185.120.147.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB979A8FE /* 185.121.168.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB97A3BED /* 185.122.59.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB97D213A /* 185.125.33.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB97DD942 /* 185.125.217.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB97DDBCB /* 185.125.219.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB98028EA /* 185.128.40.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9813C83 /* 185.129.60.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9813E3E /* 185.129.62.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9813E3F /* 185.129.62.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB98194D2 /* 185.129.148.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB98194D6 /* 185.129.148.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9879C5E /* 185.135.156.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB98F65FD /* 185.143.101.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9918065 /* 185.145.128.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9918095 /* 185.145.128.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB99181BA /* 185.145.129.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB99181C5 /* 185.145.129.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB992A813 /* 185.146.168.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB992A9C1 /* 185.146.169.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB992AA81 /* 185.146.170.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB992ABE7 /* 185.146.171.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB996BDAF /* 185.150.189.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB998E823 /* 185.152.232.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB999C572 /* 185.153.197.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB999C57D /* 185.153.197.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB999C60B /* 185.153.198.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB999C6DE /* 185.153.198.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB99C4084 /* 185.156.64.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB99CAD94 /* 185.156.173.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB99F522B /* 185.159.82.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A20A6E /* 185.162.10.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A20A79 /* 185.162.10.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A32D18 /* 185.163.45.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A32D96 /* 185.163.45.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A32DB0 /* 185.163.45.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A32DC1 /* 185.163.45.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A32DF3 /* 185.163.45.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A32DF9 /* 185.163.45.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A48873 /* 185.164.136.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A85E /* 185.165.168.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A861 /* 185.165.168.97/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A862 /* 185.165.168.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A87B /* 185.165.168.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A8A8 /* 185.165.168.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A8AA /* 185.165.168.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A8AD /* 185.165.168.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5A8C4 /* 185.165.168.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A5F38D /* 185.165.243.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9A9E5A3 /* 185.169.229.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9AFD0B3 /* 185.175.208.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9AFD0B4 /* 185.175.208.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9B150F8 /* 185.177.80.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9B50815 /* 185.181.8.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9B56551 /* 185.181.101.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9B5E54D /* 185.181.229.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9B63254 /* 185.182.50.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xB9B63256 /* 185.182.50.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBA95F912 /* 186.149.249.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBACCF34A /* 186.204.243.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBACED69A /* 186.206.214.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBAE7787D /* 186.231.120.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBB3D899C /* 187.61.137.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBB3F6418 /* 187.63.100.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBBA354CD /* 187.163.84.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBBA738D4 /* 187.167.56.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC045A36 /* 188.4.90.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC16BC3B /* 188.22.188.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC17C56E /* 188.23.197.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC181FD5 /* 188.24.31.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC20E27B /* 188.32.226.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC20F2F4 /* 188.32.242.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC282973 /* 188.40.41.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC282AC3 /* 188.40.42.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC282C77 /* 188.40.44.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC283156 /* 188.40.49.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC2833E8 /* 188.40.51.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC284C73 /* 188.40.76.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC285B57 /* 188.40.91.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC286345 /* 188.40.99.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC286BCD /* 188.40.107.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC286D92 /* 188.40.109.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC2880F6 /* 188.40.128.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC28A61D /* 188.40.166.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC28CE05 /* 188.40.206.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC28EBD7 /* 188.40.235.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC28F839 /* 188.40.248.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC2AD853 /* 188.42.216.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC2AFD07 /* 188.42.253.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC2AFE2F /* 188.42.254.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC402D69 /* 188.64.45.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC44202A /* 188.68.32.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC4424D1 /* 188.68.36.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC4439BC /* 188.68.57.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC4DD3A0 /* 188.77.211.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC52A824 /* 188.82.168.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC5DD54B /* 188.93.213.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC614BED /* 188.97.75.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC61A044 /* 188.97.160.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC620431 /* 188.98.4.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC63D545 /* 188.99.213.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC66949C /* 188.102.148.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC66F7E4 /* 188.102.247.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC671F6D /* 188.103.31.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC672E4A /* 188.103.46.74/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC6972F8 /* 188.105.114.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC6BEFDF /* 188.107.239.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC728CF5 /* 188.114.140.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC728E48 /* 188.114.142.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC76D9EC /* 188.118.217.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC77976C /* 188.119.151.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC78EA1A /* 188.120.234.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC78F125 /* 188.120.241.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC78F178 /* 188.120.241.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC78F320 /* 188.120.243.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC78FB81 /* 188.120.251.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC7AD504 /* 188.122.213.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC7B6E0F /* 188.123.110.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC7E519B /* 188.126.81.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC7E5AD3 /* 188.126.90.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC7E5E4D /* 188.126.94.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC86055C /* 188.134.5.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC8A3DA5 /* 188.138.61.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC8A4B65 /* 188.138.75.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC8A6662 /* 188.138.102.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC8A6995 /* 188.138.105.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC8A703C /* 188.138.112.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC8D4955 /* 188.141.73.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBC8F6EB5 /* 188.143.110.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA49A12 /* 188.164.154.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA500AB /* 188.165.0.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5050E /* 188.165.5.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA50642 /* 188.165.6.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5133D /* 188.165.19.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA51C98 /* 188.165.28.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA532F4 /* 188.165.50.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA53B2B /* 188.165.59.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA56AF9 /* 188.165.106.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA58A06 /* 188.165.138.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5919D /* 188.165.145.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5C2C3 /* 188.165.194.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5D498 /* 188.165.212.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5D59C /* 188.165.213.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5E426 /* 188.165.228.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5F108 /* 188.165.241.8/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA5F530 /* 188.165.245.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6036B /* 188.166.3.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6046D /* 188.166.4.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA604D1 /* 188.166.4.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA60898 /* 188.166.8.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA61057 /* 188.166.16.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6105B /* 188.166.16.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA61096 /* 188.166.16.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA61143 /* 188.166.17.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA61168 /* 188.166.17.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6177F /* 188.166.23.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA617F7 /* 188.166.23.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA620C8 /* 188.166.32.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA62296 /* 188.166.34.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA623AB /* 188.166.35.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA628C3 /* 188.166.40.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6292E /* 188.166.41.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA629D2 /* 188.166.41.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA62DEA /* 188.166.45.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA632DE /* 188.166.50.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA643E7 /* 188.166.67.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6523D /* 188.166.82.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA657A1 /* 188.166.87.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6699D /* 188.166.105.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA67A3A /* 188.166.122.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA68585 /* 188.166.133.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA69577 /* 188.166.149.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA69E64 /* 188.166.158.100/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6A7E6 /* 188.166.167.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6A849 /* 188.166.168.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6B1B8 /* 188.166.177.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6B238 /* 188.166.178.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6B921 /* 188.166.185.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6D1AC /* 188.166.209.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6DBCF /* 188.166.219.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6E9E6 /* 188.166.233.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6F0B6 /* 188.166.240.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6F14B /* 188.166.241.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6F5D9 /* 188.166.245.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6F66A /* 188.166.246.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA6FFD1 /* 188.166.255.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA74043 /* 188.167.64.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCA8225A /* 188.168.34.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCAE5BDE /* 188.174.91.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCAEA8C5 /* 188.174.168.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCAEAAE5 /* 188.174.170.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCAEB70A /* 188.174.183.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCB78653 /* 188.183.134.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCBBC04B /* 188.187.192.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC0359E /* 188.192.53.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC086DE /* 188.192.134.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC08E02 /* 188.192.142.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC099B8 /* 188.192.153.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC0A25A /* 188.192.162.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC0F519 /* 188.192.245.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC13139 /* 188.193.49.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC16C21 /* 188.193.108.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC16D84 /* 188.193.109.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC1A930 /* 188.193.169.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC233FB /* 188.194.51.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC23C1E /* 188.194.60.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC24F69 /* 188.194.79.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC279E1 /* 188.194.121.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC2F8F9 /* 188.194.248.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC30F2A /* 188.195.15.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC329A5 /* 188.195.41.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC3ACDF /* 188.195.172.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCC3AD19 /* 188.195.173.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD13122 /* 188.209.49.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD51CDE /* 188.213.28.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD53137 /* 188.213.49.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD58F77 /* 188.213.143.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD5A565 /* 188.213.165.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD5A6ED /* 188.213.166.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD5AA68 /* 188.213.170.104/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD61E99 /* 188.214.30.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD68040 /* 188.214.128.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD68115 /* 188.214.129.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCD68155 /* 188.214.129.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCDBE8A2 /* 188.219.232.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCDE6AEF /* 188.222.106.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE23EBA /* 188.226.62.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE24784 /* 188.226.71.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE28258 /* 188.226.130.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE2957C /* 188.226.149.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE2DDF3 /* 188.226.221.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE2DE13 /* 188.226.222.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE2ED9A /* 188.226.237.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE2F756 /* 188.226.247.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE2FDB5 /* 188.226.253.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE3C986 /* 188.227.201.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE43194 /* 188.228.49.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCE813A5 /* 188.232.19.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCF0D059 /* 188.240.208.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCF2827A /* 188.242.130.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCF42660 /* 188.244.38.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCF42B19 /* 188.244.43.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCF48F6B /* 188.244.143.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBCF6CC43 /* 188.246.204.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBD3E721D /* 189.62.114.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBD54152C /* 189.84.21.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBE08F0EE /* 190.8.240.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBE0A0832 /* 190.10.8.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBE0A0844 /* 190.10.8.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBE0A0898 /* 190.10.8.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBE0A0AAD /* 190.10.10.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBE61A58D /* 190.97.165.141/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBE7B2F74 /* 190.123.47.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBED2625A /* 190.210.98.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBED2B6AD /* 190.210.182.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBED80288 /* 190.216.2.136/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBEF55206 /* 190.245.82.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBF60F96E /* 191.96.249.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBF651F54 /* 191.101.31.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBF6532FC /* 191.101.50.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xBF705F5B /* 191.112.95.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC000E651 /* 192.0.230.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC003941B /* 192.3.148.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC003D90C /* 192.3.217.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC01E202C /* 192.30.32.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC01F17F3 /* 192.31.23.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC021D21E /* 192.33.210.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0223F89 /* 192.34.63.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC02250B0 /* 192.34.80.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0241B04 /* 192.36.27.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0241B06 /* 192.36.27.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0241B07 /* 192.36.27.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0242621 /* 192.36.38.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC02A7166 /* 192.42.113.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC02A7365 /* 192.42.115.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC02A7366 /* 192.42.115.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC02A7410 /* 192.42.116.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC02A74A1 /* 192.42.116.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC02C1E28 /* 192.44.30.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC034A746 /* 192.52.167.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC034A747 /* 192.52.167.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC047F524 /* 192.71.245.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC047F589 /* 192.71.245.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC047F5D7 /* 192.71.245.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC049EF53 /* 192.73.239.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0518331 /* 192.81.131.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC051842E /* 192.81.132.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC051D97E /* 192.81.217.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC051DA89 /* 192.81.218.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC051FA76 /* 192.81.250.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0571C1C /* 192.87.28.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0571C52 /* 192.87.28.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC05F1692 /* 192.95.22.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC05F19CA /* 192.95.25.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC05F1B8F /* 192.95.27.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0630BC8 /* 192.99.11.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0630C95 /* 192.99.12.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0630D30 /* 192.99.13.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0630FDC /* 192.99.15.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC063259C /* 192.99.37.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0632DE5 /* 192.99.45.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC063364F /* 192.99.54.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0633F2C /* 192.99.63.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0634473 /* 192.99.68.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0639AEA /* 192.99.154.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC063D48B /* 192.99.212.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC063F665 /* 192.99.246.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC06F9072 /* 192.111.144.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0794449 /* 192.121.68.73/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC07CFA53 /* 192.124.250.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC087A8FB /* 192.135.168.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC096BB89 /* 192.150.187.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0999AF4 /* 192.153.154.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC09B5365 /* 192.155.83.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC09B5D65 /* 192.155.93.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC09B5FDE /* 192.155.95.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC09DEFF3 /* 192.157.239.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC09DFD7D /* 192.157.253.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A066A4 /* 192.160.102.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A066A5 /* 192.160.102.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A066A6 /* 192.160.102.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A066A7 /* 192.160.102.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A066A8 /* 192.160.102.168/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A066A9 /* 192.160.102.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A066AA /* 192.160.102.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A1B431 /* 192.161.180.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A28D35 /* 192.162.141.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A3E033 /* 192.163.224.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A4FA32 /* 192.164.250.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A543FE /* 192.165.67.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A6DA3F /* 192.166.218.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A6DBC2 /* 192.166.219.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A9A69D /* 192.169.166.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0A9A827 /* 192.169.168.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0B7CE2A /* 192.183.206.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0B851A0 /* 192.184.81.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0B85280 /* 192.184.82.128/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0B85E6F /* 192.184.94.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0BB7C62 /* 192.187.124.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0C3500A /* 192.195.80.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0C35386 /* 192.195.83.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0D2C0E5 /* 192.210.192.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0D2CB10 /* 192.210.203.16/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0D2D37B /* 192.210.211.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0DED68B /* 192.222.214.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0E3A054 /* 192.227.160.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0E3AFEF /* 192.227.175.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0E4A702 /* 192.228.167.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F07B02 /* 192.240.123.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1823C /* 192.241.130.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1863E /* 192.241.134.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1946C /* 192.241.148.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1B41B /* 192.241.180.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1B4A3 /* 192.241.180.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1B5E9 /* 192.241.181.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1C15D /* 192.241.193.93/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1C3B2 /* 192.241.195.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1C66A /* 192.241.198.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1CA6F /* 192.241.202.111/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1CEAB /* 192.241.206.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1D1C1 /* 192.241.209.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1D265 /* 192.241.210.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1D878 /* 192.241.216.120/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1E93A /* 192.241.233.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F1E9CB /* 192.241.233.203/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F462A6 /* 192.244.98.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F70D29 /* 192.247.13.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0F93CC2 /* 192.249.60.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC0FCA537 /* 192.252.165.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC100D52A /* 193.0.213.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC107B1DF /* 193.7.177.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10A0599 /* 193.10.5.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10B70A7 /* 193.11.112.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10B722B /* 193.11.114.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10B722D /* 193.11.114.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10B722E /* 193.11.114.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10B722F /* 193.11.114.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10BA4F3 /* 193.11.164.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10BA6C2 /* 193.11.166.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC10F1004 /* 193.15.16.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC117F4F4 /* 193.23.244.244/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC118D146 /* 193.24.209.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC118D27E /* 193.24.210.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC11DBB4B /* 193.29.187.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC11DBB4E /* 193.29.187.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC11DBB6A /* 193.29.187.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1233435 /* 193.35.52.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC12598C7 /* 193.37.152.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC12A9C6A /* 193.42.156.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1462698 /* 193.70.38.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1462B4C /* 193.70.43.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1465AC7 /* 193.70.90.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC151D8E3 /* 193.81.216.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC15A0C56 /* 193.90.12.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC15A0C57 /* 193.90.12.87/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC15A0C58 /* 193.90.12.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC15A0C59 /* 193.90.12.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC15A0C5A /* 193.90.12.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC168A903 /* 193.104.169.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC168DC23 /* 193.104.220.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC168DC36 /* 193.104.220.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1694950 /* 193.105.73.80/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1698667 /* 193.105.134.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16AA51B /* 193.106.165.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16B5538 /* 193.107.85.56/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16B5539 /* 193.107.85.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16B553E /* 193.107.85.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16CF9D7 /* 193.108.249.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16E9D97 /* 193.110.157.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16F1A25 /* 193.111.26.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16F8820 /* 193.111.136.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC16F8DA0 /* 193.111.141.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC17CB532 /* 193.124.181.50/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC17CB6BF /* 193.124.182.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC18A765E /* 193.138.118.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC18CE034 /* 193.140.224.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1960E3C /* 193.150.14.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC196791A /* 193.150.121.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC196794E /* 193.150.121.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1A48535 /* 193.164.133.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1A4D955 /* 193.164.217.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1A589CA /* 193.165.137.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1A98785 /* 193.169.135.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1A9879A /* 193.169.135.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1A9879D /* 193.169.135.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1ABCA92 /* 193.171.202.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1ABCA9A /* 193.171.202.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1AE0614 /* 193.174.6.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1B69035 /* 193.182.144.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1B7626D /* 193.183.98.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1B769CD /* 193.183.105.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1BEA835 /* 193.190.168.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1C66803 /* 193.198.104.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1C8F1C3 /* 193.200.241.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1C9E12D /* 193.201.225.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1D2E00D /* 193.210.224.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1E0A32B /* 193.224.163.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1E3C40A /* 193.227.196.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1E48F11 /* 193.228.143.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC1E48FE1 /* 193.228.143.225/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC201EE73 /* 194.1.238.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC20F7323 /* 194.15.115.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC22A6C05 /* 194.42.108.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC23F8BE6 /* 194.63.139.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC23F8E0B /* 194.63.142.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC243D67B /* 194.67.214.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC24F1F12 /* 194.79.31.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2575FB1 /* 194.87.95.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2588F42 /* 194.88.143.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC26DCED4 /* 194.109.206.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC27EAF9D /* 194.126.175.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC291D134 /* 194.145.209.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2BBCF2D /* 194.187.207.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2BBF80F /* 194.187.248.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2BBF974 /* 194.187.249.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2BFFE97 /* 194.191.254.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2DA034F /* 194.218.3.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC2ED9DB8 /* 194.237.157.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3012906 /* 195.1.41.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC30C3044 /* 195.12.48.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC30C304C /* 195.12.48.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC30C304D /* 195.12.48.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC30CBE26 /* 195.12.190.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3105805 /* 195.16.88.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC31E6BDC /* 195.30.107.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC328B523 /* 195.40.181.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC32A73A2 /* 195.42.115.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3391CCC /* 195.57.28.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33B6622 /* 195.59.102.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33B6623 /* 195.59.102.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33B6624 /* 195.59.102.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33B6625 /* 195.59.102.37/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33B6626 /* 195.59.102.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33BD0A2 /* 195.59.208.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33BD0A3 /* 195.59.208.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33BD0A4 /* 195.59.208.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33BD0A5 /* 195.59.208.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33BD0A6 /* 195.59.208.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC33E353A /* 195.62.53.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC344D71E /* 195.68.215.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3474454 /* 195.71.68.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC35298D0 /* 195.82.152.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC35BF462 /* 195.91.244.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC37BD1B8 /* 195.123.209.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC37BD226 /* 195.123.210.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC37BD25F /* 195.123.210.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC37BD284 /* 195.123.210.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC37BD422 /* 195.123.212.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3845544 /* 195.132.85.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC38A5E66 /* 195.138.94.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3947CC7 /* 195.148.124.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A0A6A /* 195.154.10.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A0C42 /* 195.154.12.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A0C92 /* 195.154.12.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A0D60 /* 195.154.13.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A411D /* 195.154.65.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A4B1D /* 195.154.75.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A4B54 /* 195.154.75.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A4BA5 /* 195.154.75.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A4D95 /* 195.154.77.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A4FC7 /* 195.154.79.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A516C /* 195.154.81.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A516E /* 195.154.81.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A518F /* 195.154.81.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A51A9 /* 195.154.81.169/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A51E3 /* 195.154.81.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A51F5 /* 195.154.81.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A5258 /* 195.154.82.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A52B4 /* 195.154.82.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A56F9 /* 195.154.86.249/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A57E7 /* 195.154.87.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A5A83 /* 195.154.90.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A5B3D /* 195.154.91.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A5B8B /* 195.154.91.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A5BC2 /* 195.154.91.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A5C46 /* 195.154.92.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A5C9B /* 195.154.92.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A600E /* 195.154.96.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A612B /* 195.154.97.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A61A0 /* 195.154.97.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A61A3 /* 195.154.97.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6935 /* 195.154.105.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6939 /* 195.154.105.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6B17 /* 195.154.107.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6B97 /* 195.154.107.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6C0C /* 195.154.108.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6C4E /* 195.154.108.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6D9D /* 195.154.109.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A6F75 /* 195.154.111.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A714F /* 195.154.113.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A71C8 /* 195.154.113.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A74E8 /* 195.154.116.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A75A3 /* 195.154.117.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A75B6 /* 195.154.117.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A79C6 /* 195.154.121.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A7A20 /* 195.154.122.32/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A7A36 /* 195.154.122.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A7A8A /* 195.154.122.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A7BE3 /* 195.154.123.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A7E2B /* 195.154.126.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39A7FF6 /* 195.154.127.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA123 /* 195.154.161.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA12F /* 195.154.161.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA2AC /* 195.154.162.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA377 /* 195.154.163.119/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA422 /* 195.154.164.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA4F3 /* 195.154.164.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA540 /* 195.154.165.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AA570 /* 195.154.165.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AAB18 /* 195.154.171.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AAC16 /* 195.154.172.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AB79F /* 195.154.183.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AC881 /* 195.154.200.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AD15B /* 195.154.209.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AE9BA /* 195.154.233.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AED93 /* 195.154.237.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AF091 /* 195.154.240.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AF17D /* 195.154.241.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AFAEF /* 195.154.250.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AFC58 /* 195.154.252.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AFDE2 /* 195.154.253.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39AFFAE /* 195.154.255.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC39FCC5E /* 195.159.204.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3A97DE2 /* 195.169.125.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3B2A648 /* 195.178.166.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3B40BC4 /* 195.180.11.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3BFE9DD /* 195.191.233.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3C8ECC5 /* 195.200.236.197/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3D08B84 /* 195.208.139.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3E1D31A /* 195.225.211.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3E42DB0 /* 195.228.45.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3E44B95 /* 195.228.75.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3E6A853 /* 195.230.168.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3EA9856 /* 195.234.152.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3EEBE65 /* 195.238.190.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC3FE874C /* 195.254.135.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC5E7DDD3 /* 197.231.221.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC60C5F30 /* 198.12.95.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6105C9D /* 198.16.92.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6178523 /* 198.23.133.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC61B40D7 /* 198.27.64.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC61B429F /* 198.27.66.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC61B42D1 /* 198.27.66.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC61B45C9 /* 198.27.69.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC61B56DD /* 198.27.86.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC61B61B8 /* 198.27.97.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC61B6D24 /* 198.27.109.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC62E8A12 /* 198.46.138.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC62E8A28 /* 198.46.138.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC62E9933 /* 198.46.153.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC62E9979 /* 198.46.153.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6314912 /* 198.49.73.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6328137 /* 198.50.129.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63285F5 /* 198.50.133.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63287D5 /* 198.50.135.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63291CF /* 198.50.145.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63292FC /* 198.50.146.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6329346 /* 198.50.147.70/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6329F9B /* 198.50.159.155/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC632BF5F /* 198.50.191.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC632C886 /* 198.50.200.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC632C887 /* 198.50.200.135/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC632F552 /* 198.50.245.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63A64F0 /* 198.58.100.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63A66EA /* 198.58.102.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63A6B35 /* 198.58.107.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63A6EDF /* 198.58.110.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC63A73D2 /* 198.58.115.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6475142 /* 198.71.81.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC648E523 /* 198.72.229.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6493247 /* 198.73.50.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC64A38BF /* 198.74.56.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC64A3939 /* 198.74.57.57/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC64A3C1A /* 198.74.60.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC64A3C52 /* 198.74.60.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC64A3D33 /* 198.74.61.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6609B03 /* 198.96.155.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC66232D4 /* 198.98.50.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC662337C /* 198.98.51.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6623505 /* 198.98.53.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC66493B8 /* 198.100.147.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6649470 /* 198.100.148.112/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6649492 /* 198.100.148.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6649F36 /* 198.100.159.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC68F88E4 /* 198.143.136.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC68F88ED /* 198.143.136.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6931652 /* 198.147.22.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC69451A7 /* 198.148.81.167/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC69A6A36 /* 198.154.106.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6A7DF21 /* 198.167.223.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6A7DF26 /* 198.167.223.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6A7DF2C /* 198.167.223.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6A7DF4B /* 198.167.223.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C740D9 /* 198.199.64.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C74896 /* 198.199.72.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C748B3 /* 198.199.72.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C75A33 /* 198.199.90.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C75ACD /* 198.199.90.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C767B2 /* 198.199.103.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C76840 /* 198.199.104.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C77079 /* 198.199.112.121/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C770F7 /* 198.199.112.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C775A4 /* 198.199.117.164/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6C77686 /* 198.199.118.134/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6D3671A /* 198.211.103.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6D3788A /* 198.211.120.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6D37ABF /* 198.211.122.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6D37CD6 /* 198.211.124.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6D37DF2 /* 198.211.125.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6E9CCA5 /* 198.233.204.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6F468AE /* 198.244.104.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6F532AF /* 198.245.50.175/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6F53348 /* 198.245.51.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6F53D95 /* 198.245.61.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6FC794F /* 198.252.121.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6FC9945 /* 198.252.153.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6FC996B /* 198.252.153.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6FF5E72 /* 198.255.94.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC6FFB101 /* 198.255.177.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC70FFAD2 /* 199.15.250.210/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC71355FC /* 199.19.85.252/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC713D5B0 /* 199.19.213.176/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC744C47B /* 199.68.196.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC744C47C /* 199.68.196.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC744C47D /* 199.68.196.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC744C47E /* 199.68.196.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC747EA42 /* 199.71.234.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC74ADEAB /* 199.74.222.171/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7579AFF /* 199.87.154.255/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC773CDF8 /* 199.115.205.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC77FE296 /* 199.127.226.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7BCC235 /* 199.188.194.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7BD3EFB /* 199.189.62.251/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7BD564F /* 199.189.86.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7C3F9D4 /* 199.195.249.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7C3F9DD /* 199.195.249.221/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7F11DDF /* 199.241.29.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7FEEE2C /* 199.254.238.44/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7FEEE35 /* 199.254.238.53/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC7FFDF58 /* 199.255.223.88/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC87AB50F /* 200.122.181.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC8810B03 /* 200.129.11.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC8810B05 /* 200.129.11.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC8810B07 /* 200.129.11.7/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC8E5C1C2 /* 200.229.193.194/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC944D734 /* 201.68.215.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC9561F26 /* 201.86.31.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xC9837EC9 /* 201.131.126.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCA81509A /* 202.129.80.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCA8F5548 /* 202.143.85.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCB6DEA48 /* 203.109.234.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCB8D9ACA /* 203.141.154.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCBBA4562 /* 203.186.69.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCBD9AD92 /* 203.217.173.146/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCBDC5CE6 /* 203.220.92.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCBDDCF6C /* 203.221.207.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC089C8E /* 204.8.156.142/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC093219 /* 204.9.50.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC0B3283 /* 204.11.50.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC0DA46E /* 204.13.164.110/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC11382A /* 204.17.56.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC1B3C93 /* 204.27.60.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC2C5903 /* 204.44.89.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC55BF1E /* 204.85.191.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC66E0ED /* 204.102.224.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC98DC44 /* 204.152.220.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC98DCF7 /* 204.152.220.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCC98DCF8 /* 204.152.220.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCCC21D04 /* 204.194.29.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCDA85485 /* 205.168.84.133/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCDB9733C /* 205.185.115.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCDB97E76 /* 205.185.126.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCE2876E5 /* 206.40.118.229/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCE36A784 /* 206.54.167.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCE374A00 /* 206.55.74.0/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCE374A01 /* 206.55.74.1/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCE3FE590 /* 206.63.229.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCEAE719C /* 206.174.113.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCEB71F06 /* 206.183.31.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCEF8B87F /* 206.248.184.127/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCF265260 /* 207.38.82.96/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCF26D9BA /* 207.38.217.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCF26E8C8 /* 207.38.232.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCF701236 /* 207.112.18.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCFAC3596 /* 207.172.53.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCFC046FA /* 207.192.70.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xCFF44623 /* 207.244.70.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD0240203 /* 208.36.2.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD0240204 /* 208.36.2.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD0240205 /* 208.36.2.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD026F36B /* 208.38.243.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD040AFD9 /* 208.64.175.217/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD04FD17C /* 208.79.209.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD0509A27 /* 208.80.154.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD053DF22 /* 208.83.223.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD059D3D0 /* 208.89.211.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD05EF21A /* 208.94.242.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD05EF2DE /* 208.94.242.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD05F031C /* 208.95.3.28/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD071A605 /* 208.113.166.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD076EB30 /* 208.118.235.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1064FB4 /* 209.6.79.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1068F99 /* 209.6.143.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD10F4ECD /* 209.15.78.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD12C72B2 /* 209.44.114.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD13AA08A /* 209.58.160.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD13AB45A /* 209.58.180.90/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1427796 /* 209.66.119.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD15AE005 /* 209.90.224.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD17BEA17 /* 209.123.234.23/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD17E47E9 /* 209.126.71.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD17E67CE /* 209.126.103.206/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18542D6 /* 209.133.66.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18D22F0 /* 209.141.34.240/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18D242A /* 209.141.36.42/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18D2816 /* 209.141.40.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18D3126 /* 209.141.49.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18D328A /* 209.141.50.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18D340D /* 209.141.52.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD18D3A44 /* 209.141.58.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD19F899C /* 209.159.137.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1A6AC0A /* 209.166.172.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1ABA216 /* 209.171.162.22/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1B53DDB /* 209.181.61.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1D04F05 /* 209.208.79.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1D2D215 /* 209.210.210.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1DE4DDC /* 209.222.77.220/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1F06DEE /* 209.240.109.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1F99D45 /* 209.249.157.69/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1F9B4C6 /* 209.249.180.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD1FA06BE /* 209.250.6.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD2036698 /* 210.3.102.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD203669A /* 210.3.102.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD20366A5 /* 210.3.102.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD2362318 /* 210.54.35.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD298F13C /* 210.152.241.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD31AF589 /* 211.26.245.137/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD34C375C /* 211.76.55.92/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD37858ED /* 211.120.88.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD40370E2 /* 212.3.112.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD407D934 /* 212.7.217.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4106821 /* 212.16.104.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD410AA9E /* 212.16.170.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD411664D /* 212.17.102.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD41311D5 /* 212.19.17.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4143EE2 /* 212.20.62.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4154206 /* 212.21.66.6/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4190B15 /* 212.25.11.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD41A8C51 /* 212.26.140.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD41AF522 /* 212.26.245.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FDFC6 /* 212.47.223.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE295 /* 212.47.226.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE347 /* 212.47.227.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE34B /* 212.47.227.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE372 /* 212.47.227.114/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE3C3 /* 212.47.227.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE3EC /* 212.47.227.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE473 /* 212.47.228.115/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE502 /* 212.47.229.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE58A /* 212.47.229.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE605 /* 212.47.230.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE631 /* 212.47.230.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE7F1 /* 212.47.231.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE8E3 /* 212.47.232.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE8EC /* 212.47.232.236/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE8ED /* 212.47.232.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE921 /* 212.47.233.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE956 /* 212.47.233.86/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FE9EB /* 212.47.233.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEAC0 /* 212.47.234.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEAD4 /* 212.47.234.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEB51 /* 212.47.235.81/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEC9D /* 212.47.236.157/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FED5F /* 212.47.237.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEE41 /* 212.47.238.65/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEEC1 /* 212.47.238.193/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEF53 /* 212.47.239.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEF97 /* 212.47.239.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEFA3 /* 212.47.239.163/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FEFBB /* 212.47.239.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF00A /* 212.47.240.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF0BD /* 212.47.240.189/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF115 /* 212.47.241.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF35B /* 212.47.243.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF38C /* 212.47.243.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF3A6 /* 212.47.243.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF426 /* 212.47.244.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF462 /* 212.47.244.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF54C /* 212.47.245.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF5E3 /* 212.47.245.227/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF612 /* 212.47.246.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF615 /* 212.47.246.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF6D3 /* 212.47.246.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF871 /* 212.47.248.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FF93F /* 212.47.249.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FFBB3 /* 212.47.251.179/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FFDDF /* 212.47.253.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD42FFE82 /* 212.47.254.130/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD433867B /* 212.51.134.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4338AC4 /* 212.51.138.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4338F14 /* 212.51.143.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD43393ED /* 212.51.147.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4339619 /* 212.51.150.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD43396B8 /* 212.51.150.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4339755 /* 212.51.151.85/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD43397FA /* 212.51.151.250/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4339C4E /* 212.51.156.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4339E47 /* 212.51.158.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD438582F /* 212.56.88.47/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD438D6B2 /* 212.56.214.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD43C7E33 /* 212.60.126.51/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD43C8248 /* 212.60.130.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD444E4D5 /* 212.68.228.213/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD445A67A /* 212.69.166.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD445A699 /* 212.69.166.153/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD447FC74 /* 212.71.252.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD447FDE2 /* 212.71.253.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD448B013 /* 212.72.176.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD44AFEF3 /* 212.74.254.243/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD451C79F /* 212.81.199.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD45328EE /* 212.83.40.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD45328EF /* 212.83.40.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4538F2E /* 212.83.143.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4539A21 /* 212.83.154.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4539E05 /* 212.83.158.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4539E14 /* 212.83.158.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD453AE1A /* 212.83.174.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD453B03A /* 212.83.176.58/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD459E1F2 /* 212.89.225.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD45CD6F6 /* 212.92.214.246/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD45CDB0F /* 212.92.219.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD46B9CE2 /* 212.107.156.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD46B9CEE /* 212.107.156.238/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD46DD983 /* 212.109.217.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD46F28B1 /* 212.111.40.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD46F298F /* 212.111.41.143/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD472FE5B /* 212.114.254.91/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD475B421 /* 212.117.180.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD475B42D /* 212.117.180.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD475B46B /* 212.117.180.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4763E03 /* 212.118.62.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4810454 /* 212.129.4.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD48126FE /* 212.129.38.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4812A09 /* 212.129.42.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD481313B /* 212.129.49.59/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4813431 /* 212.129.52.49/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4813EE8 /* 212.129.62.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD496868C /* 212.150.134.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD49F4FE4 /* 212.159.79.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD49F5B15 /* 212.159.91.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD49F64E8 /* 212.159.100.232/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD49F70C4 /* 212.159.112.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD49FB1C6 /* 212.159.177.198/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4B5CE7A /* 212.181.206.122/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4B7D5E4 /* 212.183.213.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4BA4726 /* 212.186.71.38/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4BA59A2 /* 212.186.89.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4BB6183 /* 212.187.97.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4BBC8AA /* 212.187.200.170/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4C94483 /* 212.201.68.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4C94498 /* 212.201.68.152/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4E04C94 /* 212.224.76.148/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4E04EEA /* 212.224.78.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4E05FA1 /* 212.224.95.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4E05FE7 /* 212.224.95.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4E30936 /* 212.227.9.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4E81D65 /* 212.232.29.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4EEA021 /* 212.238.160.33/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4EED030 /* 212.238.208.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD4FBD3FE /* 212.251.211.254/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD50544CA /* 213.5.68.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5117CB2 /* 213.17.124.178/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5150A1E /* 213.21.10.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD520136C /* 213.32.19.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5201537 /* 213.32.21.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD52037C3 /* 213.32.55.195/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD52037F7 /* 213.32.55.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD52042C0 /* 213.32.66.192/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5204465 /* 213.32.68.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5205A0F /* 213.32.90.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5205A9A /* 213.32.90.154/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD52077DB /* 213.32.119.219/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD52F3136 /* 213.47.49.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD53D4274 /* 213.61.66.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD53D4275 /* 213.61.66.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD53D4276 /* 213.61.66.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD53D957D /* 213.61.149.125/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD53D957E /* 213.61.149.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD540416A /* 213.64.65.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD54963B6 /* 213.73.99.182/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD55F1536 /* 213.95.21.54/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD55F56B4 /* 213.95.86.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD56C6947 /* 213.108.105.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD56C6CEB /* 213.108.108.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD56D38C8 /* 213.109.56.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5708465 /* 213.112.132.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5717475 /* 213.113.116.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD571778A /* 213.113.119.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5729166 /* 213.114.145.102/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD57292BB /* 213.114.146.187/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD57295A0 /* 213.114.149.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD572E11E /* 213.114.225.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD572E952 /* 213.114.233.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD57CA99F /* 213.124.169.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD57CB319 /* 213.124.179.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58306BA /* 213.131.6.186/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD585639C /* 213.133.99.156/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD587C66A /* 213.135.198.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58845A2 /* 213.136.69.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58845ED /* 213.136.69.237/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5884715 /* 213.136.71.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD588506D /* 213.136.80.109/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5885159 /* 213.136.81.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5885CBC /* 213.136.92.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5885E0A /* 213.136.94.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58A66D1 /* 213.138.102.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58A6D90 /* 213.138.109.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58A6F1F /* 213.138.111.31/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58C5CC7 /* 213.140.92.199/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58D82E7 /* 213.141.130.231/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58D8AAE /* 213.141.138.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD58D9613 /* 213.141.150.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5909D4B /* 213.144.157.75/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5975904 /* 213.151.89.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD598A11E /* 213.152.161.30/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD598A128 /* 213.152.161.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD59954D7 /* 213.153.84.215/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD59D0FEB /* 213.157.15.235/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD59FD02B /* 213.159.208.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5A1050C /* 213.161.5.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5A296BF /* 213.162.150.191/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5A346EA /* 213.163.70.234/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5A354C4 /* 213.163.84.196/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5A354CC /* 213.163.84.204/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5A354CD /* 213.163.84.205/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5A7F2B7 /* 213.167.242.183/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5B5CD3D /* 213.181.205.61/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5B5CD3E /* 213.181.205.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5B5CD3F /* 213.181.205.63/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5B7388C /* 213.183.56.140/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5B87E02 /* 213.184.126.2/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5B87EF2 /* 213.184.126.242/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5BC3465 /* 213.188.52.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5BCF58B /* 213.188.245.139/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5BF1B7B /* 213.191.27.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5C5167C /* 213.197.22.124/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5C52623 /* 213.197.38.35/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5CAE924 /* 213.202.233.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5E1A0DF /* 213.225.160.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5E2B4A6 /* 213.226.180.166/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5E9E27B /* 213.233.226.123/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFC519 /* 213.239.197.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFCA95 /* 213.239.202.149/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFCDEF /* 213.239.205.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFD329 /* 213.239.211.41/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFD414 /* 213.239.212.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFD8DE /* 213.239.216.222/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFD912 /* 213.239.217.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFD944 /* 213.239.217.68/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5EFF947 /* 213.239.249.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5F3AC2E /* 213.243.172.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5F53ED4 /* 213.245.62.212/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5F62D4C /* 213.246.45.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5F6383E /* 213.246.56.62/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5F6384F /* 213.246.56.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5F6385F /* 213.246.56.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5FBC7AE /* 213.251.199.174/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5FCA60F /* 213.252.166.15/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5FCF469 /* 213.252.244.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD5FE201A /* 213.254.32.26/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD80CC652 /* 216.12.198.82/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD80CC653 /* 216.12.198.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD80CC654 /* 216.12.198.84/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8116390 /* 216.17.99.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD811654F /* 216.17.101.79/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD818F222 /* 216.24.242.34/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD837B515 /* 216.55.181.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD87FBB1D /* 216.127.187.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD89EE2D8 /* 216.158.226.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8BAA827 /* 216.186.168.39/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8BD96B9 /* 216.189.150.185/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8C3851B /* 216.195.133.27/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8C3A84E /* 216.195.168.78/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8D37E59 /* 216.211.126.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8DA860C /* 216.218.134.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8DA9383 /* 216.218.147.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8DADE0A /* 216.218.222.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8DADE0B /* 216.218.222.11/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8DADE0C /* 216.218.222.12/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8DADE0D /* 216.218.222.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8E6944D /* 216.230.148.77/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8EF5A13 /* 216.239.90.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8F455D3 /* 216.244.85.211/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD8FCA213 /* 216.252.162.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9083D43 /* 217.8.61.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90B39E2 /* 217.11.57.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CC743 /* 217.12.199.67/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CC76C /* 217.12.199.108/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CC79E /* 217.12.199.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CC7BE /* 217.12.199.190/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CC7D0 /* 217.12.199.208/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CC7D1 /* 217.12.199.209/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CCA28 /* 217.12.202.40/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CCA4C /* 217.12.202.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CCA74 /* 217.12.202.116/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CCB2E /* 217.12.203.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CCCA1 /* 217.12.204.161/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CD075 /* 217.12.208.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CD230 /* 217.12.210.48/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CD25F /* 217.12.210.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CD2CF /* 217.12.210.207/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90CD2D6 /* 217.12.210.214/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD90DC505 /* 217.13.197.5/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD910B514 /* 217.16.181.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD910B614 /* 217.16.182.20/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9148248 /* 217.20.130.72/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9170767 /* 217.23.7.103/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9170B59 /* 217.23.11.89/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9170B8A /* 217.23.11.138/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9170D81 /* 217.23.13.129/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9170FC8 /* 217.23.15.200/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9178A69 /* 217.23.138.105/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD919AD97 /* 217.25.173.151/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD919E2A0 /* 217.25.226.160/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD91C60B4 /* 217.28.96.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD91CDAEF /* 217.28.218.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD91D3AB8 /* 217.29.58.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD92ADC0E /* 217.42.220.14/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD93214DF /* 217.50.20.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD93FFE63 /* 217.63.254.99/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD945905E /* 217.69.144.94/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD946BF0D /* 217.70.191.13/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD94FB23C /* 217.79.178.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD94FB27E /* 217.79.178.126/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD94FB3B1 /* 217.79.179.177/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD94FB65F /* 217.79.182.95/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD94FBE19 /* 217.79.190.25/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD95235B5 /* 217.82.53.181/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD95509BC /* 217.85.9.188/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD967A496 /* 217.103.164.150/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD96BC10A /* 217.107.193.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9708318 /* 217.112.131.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9708362 /* 217.112.131.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9719E34 /* 217.113.158.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD97293F5 /* 217.114.147.245/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9730A83 /* 217.115.10.131/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9730A84 /* 217.115.10.132/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD975E3E2 /* 217.117.227.226/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD97AAF13 /* 217.122.175.19/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD97AC053 /* 217.122.192.83/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9840EFD /* 217.132.14.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD993D66B /* 217.147.214.107/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD996E2B4 /* 217.150.226.180/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD99B0A12 /* 217.155.10.18/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD99B2876 /* 217.155.40.118/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9A00DAD /* 217.160.13.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9A00FF7 /* 217.160.15.247/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9A08D34 /* 217.160.141.52/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9A0B20A /* 217.160.178.10/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9A0B3E9 /* 217.160.179.233/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9AAC96A /* 217.170.201.106/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9AACD71 /* 217.170.205.113/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9AC204C /* 217.172.32.76/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9ACF73C /* 217.172.247.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9C553A2 /* 217.197.83.162/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9C55415 /* 217.197.84.21/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9C55418 /* 217.197.84.24/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9C556AD /* 217.197.86.173/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9C55B91 /* 217.197.91.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9D1B3CA /* 217.209.179.202/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9D35942 /* 217.211.89.66/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9E416D8 /* 217.228.22.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9E4D647 /* 217.228.214.71/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9E74909 /* 217.231.73.9/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9EBEDEF /* 217.235.237.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9EEEC9E /* 217.238.236.158/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9EF0D24 /* 217.239.13.36/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9F176FD /* 217.241.118.253/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9F4AB1D /* 217.244.171.29/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9F6BE2B /* 217.246.190.43/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9F942DF /* 217.249.66.223/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9FAD604 /* 217.250.214.4/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9FB0E75 /* 217.251.14.117/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9FD2262 /* 217.253.34.98/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9FD2640 /* 217.253.38.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xD9FE5EEF /* 217.254.94.239/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDAB44A3C /* 218.180.74.60/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDB4EB793 /* 219.78.183.147/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDB58E8E6 /* 219.88.232.230/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDB685CD8 /* 219.104.92.216/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDB6F57A5 /* 219.111.87.165/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDB75CE2E /* 219.117.206.46/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDB75F165 /* 219.117.241.101/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDC870EE4 /* 220.135.14.228/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDCDC4591 /* 220.220.69.145/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDCE97BAC /* 220.233.123.172/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDCE9A811 /* 220.233.168.17/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDCF05090 /* 220.240.80.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDCFD0FF1 /* 220.253.15.241/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDD274EC9 /* 221.39.78.201/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDD7999B8 /* 221.121.153.184/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDDA12637 /* 221.161.38.55/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDE036590 /* 222.3.101.144/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDE0A3840 /* 222.10.56.64/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDE9BA103 /* 222.155.161.3/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDF10252D /* 223.16.37.45/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDF1A30F8 /* 223.26.48.248/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDF87439F /* 223.135.67.159/32 */, 32, NDPI_PROTOCOL_TOR }, { 0xDF87D907 /* 223.135.217.7/32 */, 32, NDPI_PROTOCOL_TOR }, /* Twitch Interactive Inc. origin AS46489 */ { 0x17A00000 /* 23.160.0.0/24 */, 24, NDPI_PROTOCOL_TWITCH }, { 0x2D718000 /* 45.113.128.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, { 0x34DFC000 /* 52.223.192.0/20 */, 20, NDPI_PROTOCOL_TWITCH }, { 0x34DFD000 /* 52.223.208.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, { 0x34DFD800 /* 52.223.216.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, { 0x34DFE000 /* 52.223.224.0/20 */, 20, NDPI_PROTOCOL_TWITCH }, { 0x34DFF000 /* 52.223.240.0/20 */, 20, NDPI_PROTOCOL_TWITCH }, { 0x67353000 /* 103.53.48.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, { 0xB92ACC00 /* 185.42.204.0/22 */, 22, NDPI_PROTOCOL_TWITCH }, { 0xC0104000 /* 192.16.64.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, { 0xC06CEF00 /* 192.108.239.0/24 */, 24, NDPI_PROTOCOL_TWITCH }, { 0xC709F800 /* 199.9.248.0/21 */, 21, NDPI_PROTOCOL_TWITCH }, /* AnchorFree, Inc. (Hotspot Shield) origin AS26642 */ { 0x2E102200 /* 46.16.34.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x2E102300 /* 46.16.35.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x32752D00 /* 50.117.45.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x3F8DC600 /* 63.141.198.0/23 */, 23, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x4A730100 /* 74.115.1.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x4A730500 /* 74.115.5.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x4A730600 /* 74.115.6.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x55EDC500 /* 85.237.197.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0x55EDDE00 /* 85.237.222.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xC62F7300 /* 198.47.115.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xC6906800 /* 198.144.104.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xC7FFD700 /* 199.255.215.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xCC0E4A00 /* 204.14.74.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xCC0E4C00 /* 204.14.76.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xCC0E4D00 /* 204.14.77.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xCC0E4E00 /* 204.14.78.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xCDA42000 /* 205.164.32.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xD1498400 /* 209.73.132.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xD1499700 /* 209.73.151.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, { 0xD8AC8E00 /* 216.172.142.0/24 */, 24, NDPI_PROTOCOL_HOTSPOT_SHIELD }, /* GitHub, Inc. origin AS36459 */ { 0xC01EFC00 /* 192.30.252.0/22 */, 22, NDPI_PROTOCOL_GITHUB }, /* Valve Corporation (Steam) origin AS32590 */ { 0x2D79B800 /* 45.121.184.0/22 */, 22, NDPI_PROTOCOL_STEAM }, { 0x670A7C00 /* 103.10.124.0/23 */, 23, NDPI_PROTOCOL_STEAM }, { 0x671C3600 /* 103.28.54.0/23 */, 23, NDPI_PROTOCOL_STEAM }, { 0x8F899200 /* 143.137.146.0/24 */, 24, NDPI_PROTOCOL_STEAM }, { 0x92429800 /* 146.66.152.0/21 */, 21, NDPI_PROTOCOL_STEAM }, { 0x99FE5600 /* 153.254.86.0/24 */, 24, NDPI_PROTOCOL_STEAM }, { 0x9B85E000 /* 155.133.224.0/19 */, 19, NDPI_PROTOCOL_STEAM }, { 0xA2FEC000 /* 162.254.192.0/21 */, 21, NDPI_PROTOCOL_STEAM }, { 0xB919B400 /* 185.25.180.0/22 */, 22, NDPI_PROTOCOL_STEAM }, { 0xBED87900 /* 190.216.121.0/24 */, 24, NDPI_PROTOCOL_STEAM }, { 0xBED92100 /* 190.217.33.0/24 */, 24, NDPI_PROTOCOL_STEAM }, { 0xC0456000 /* 192.69.96.0/22 */, 22, NDPI_PROTOCOL_STEAM }, { 0xCDB9C200 /* 205.185.194.0/24 */, 24, NDPI_PROTOCOL_STEAM }, { 0xCDC40600 /* 205.196.6.0/24 */, 24, NDPI_PROTOCOL_STEAM }, { 0xD040C800 /* 208.64.200.0/24 */, 24, NDPI_PROTOCOL_STEAM }, { 0xD040C900 /* 208.64.201.0/22 */, 22, NDPI_PROTOCOL_STEAM }, { 0xD04EA400 /* 208.78.164.0/22 */, 22, NDPI_PROTOCOL_STEAM }, { 0x0, 0, 0 } }; /* ****************************************************** */ /* Host-based match HTTP: Server: field HTTPS: Server certificate name Risk classification criteria ---------------------------- NDPI_PROTOCOL_SAFE - Web sites (and CDNs) which are not commonly used to host malicious activities. - OS update hosts. - App stores. - Commonly used services with passwords in encrypted channels (SMTPS, POPS, etc) NDPI_PROTOCOL_ACCEPTABLE - Cloud services may be used to host malware (e.g., https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html), but it is mostly used for normal purposes. - Webmail sites, which can be used to phising. - Encrypted administrative protocols, such as SSH. - Text, voice or video communication (e.g., Skype, Slack, Whatsapp). - Ads services are commonly used to spread malware (https://www.tripwire.com/state-of-security/security-data-protection/crypto-ransomware-spreads-via-poisoned-ads-on-major-websites/) NDPI_PROTOCOL_FUN - Social media sites and services. - Communication used for fun purposes, like Snapchat, Tinder, etc. - Audio and videostreamming services (e.g., Netflix). - Game services. NDPI_PROTOCOL_UNSAFE - Unencrypted administrative protocols, such as Telnet. - Cloud hosted servers when accessed by default domains, such as *.amazonaws.com. - "AWS Supports 41% of Malware Hosting Sites, More than Any Other Web Host or ISP" http://www.thewhir.com/web-hosting-news/aws-supports-41-malware-hosting-sites-web-host-isp - https://www.scmagazine.com/600-plus-cloud-repositories-spotted-hosting-malware-and-malicious-files/article/572205/ - https://howtoremove.guide/remove-s3-amazonaws-virus/ - Torrents. - Commonly used services with passwords in unencrypted channels (SMTP, POP, etc) NDPI_PROTOCOL_POTENTIALLY_DANGEROUS - Tor and other anonymization access. - Sites commonly used to host malware and not as commonly used by "normal" users. (e.g., pastebin.com) https://isc.sans.edu/forums/diary/Many+Malware+Samples+Found+on+Pastebin/22036/ NDPI_PROTOCOL_UNRATED - Avoid this class. */ ndpi_protocol_match host_match[] = { { "amazon.", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "amazon.com", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "images-amazon.com", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "amazonaws.com", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_UNSAFE }, { "amazon-adsystem.com", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { ".cloudfront.net", "Amazon", NDPI_PROTOCOL_AMAZON, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { ".apple.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".apple-dns.net", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".mzstatic.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".aaplimg.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".icloud.com", "AppleiCloud", NDPI_PROTOCOL_APPLE_ICLOUD, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "iosapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, /* iOS */ { "osxapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, /* MacOS */ { "buy.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "su.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "se.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "myapp.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "swscan.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "itunes-apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "itunes.apple.com", "AppleiTunes", NDPI_PROTOCOL_APPLE_ITUNES, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_FUN }, { ".cnn.c", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".cnn.net", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".dropbox.com", "DropBox", NDPI_PROTOCOL_DROPBOX, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { ".dropbox-dns.com", "DropBox", NDPI_PROTOCOL_DROPBOX, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { "log.getdropbox.com", "DropBox", NDPI_PROTOCOL_DROPBOX, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { ".ebay.", "eBay", NDPI_PROTOCOL_EBAY, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, /* or FUN */ { ".ebay.com", "eBay", NDPI_PROTOCOL_EBAY, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".ebaystatic.com", "eBay", NDPI_PROTOCOL_EBAY, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".ebaydesc.com", "eBay", NDPI_PROTOCOL_EBAY, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".ebayrtm.com", "eBay", NDPI_PROTOCOL_EBAY, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".ebaystratus.com", "eBay", NDPI_PROTOCOL_EBAY, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".ebayimg.com", "eBay", NDPI_PROTOCOL_EBAY, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "facebook.com", "Facebook", NDPI_PROTOCOL_FACEBOOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "fbstatic-a.akamaihd.net", "Facebook", NDPI_PROTOCOL_FACEBOOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".fbcdn.net", "Facebook", NDPI_PROTOCOL_FACEBOOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "fbcdn-", "Facebook", NDPI_PROTOCOL_FACEBOOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".facebook.net", "Facebook", NDPI_PROTOCOL_FACEBOOK, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".speedtest.net", "Ookla", NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, NDPI_PROTOCOL_SAFE }, { "drive-thirdparty.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "docs.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".docs.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "drive.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { "android.clients.google.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "ggpht.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".gstatic.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".googlesyndication.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".googletagservices.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { ".2mdn.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { ".doubleclick.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, /* Ads */ { "googleads.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "google-analytics.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "googleusercontent.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "googleadservices.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "googleapis.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "1e100.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "maps.google.", "GoogleMaps", NDPI_PROTOCOL_GOOGLE_MAPS, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "maps.gstatic.com", "GoogleMaps", NDPI_PROTOCOL_GOOGLE_MAPS, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".gmail.", "GMail", NDPI_PROTOCOL_GMAIL, NDPI_PROTOCOL_CATEGORY_MAIL, NDPI_PROTOCOL_ACCEPTABLE }, { "mail.google.", "GMail", NDPI_PROTOCOL_GMAIL, NDPI_PROTOCOL_CATEGORY_MAIL, NDPI_PROTOCOL_ACCEPTABLE }, { "mail.outlook.com", "Hotmail", NDPI_PROTOCOL_HOTMAIL, NDPI_PROTOCOL_CATEGORY_MAIL, NDPI_PROTOCOL_ACCEPTABLE }, { ".last.fm", "LastFM", NDPI_PROTOCOL_LASTFM, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "msn.com", "MSN", NDPI_PROTOCOL_MSN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, /*News site*/ { "netflix.com", "NetFlix", NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "nflxext.com", "NetFlix", NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "nflximg.com", "NetFlix", NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "nflximg.net", "NetFlix", NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "nflxvideo.net", "NetFlix", NDPI_PROTOCOL_NETFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".skype.", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".skypeassets.", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".skypedata.", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".skypeecs-", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".skypeforbusiness.", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".lync.com", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { "e7768.b.akamaiedge.net", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { "e4593.dspg.akamaiedge.net","Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { "e4593.g.akamaiedge.net", "Skype", NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".tuenti.com", "Tuenti", NDPI_PROTOCOL_TUENTI, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".twttr.com", "Twitter", NDPI_PROTOCOL_TWITTER, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "twitter.", "Twitter", NDPI_PROTOCOL_TWITTER, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "twimg.com", "Twitter", NDPI_PROTOCOL_TWITTER, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".viber.com", "Viber", NDPI_PROTOCOL_VIBER, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { ".cdn.viber.com", "Viber", NDPI_PROTOCOL_VIBER, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { "wikipedia.", "Wikipedia", NDPI_PROTOCOL_WIKIPEDIA, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "wikimedia.", "Wikipedia", NDPI_PROTOCOL_WIKIPEDIA, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "mediawiki.", "Wikipedia", NDPI_PROTOCOL_WIKIPEDIA, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "wikimediafoundation.", "Wikipedia", NDPI_PROTOCOL_WIKIPEDIA, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".whatsapp.", "WhatsApp", NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { ".yahoo.", "Yahoo", NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".yimg.com", "Yahoo", NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "yahooapis.", "Yahoo", NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "upload.youtube.com", "YouTubeUpload", NDPI_PROTOCOL_YOUTUBE_UPLOAD, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "upload.video.google.com", "YouTubeUpload", NDPI_PROTOCOL_YOUTUBE_UPLOAD, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "youtube.", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "youtu.be.", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "yt3.ggpht.com", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".googlevideo.com", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".ytimg.com", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "youtube-nocookie.", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "ggpht.com", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "googleusercontent.com", "YouTube", NDPI_PROTOCOL_YOUTUBE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".vevo.com", "Vevo", NDPI_PROTOCOL_VEVO, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".spotify.", "Spotify", NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "audio-fa.scdn.co", "Spotify", NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".pandora.com", "Pandora", NDPI_PROTOCOL_PANDORA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".torproject.org", "Tor", NDPI_PROTOCOL_TOR, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS }, { ".kakao.com", "KakaoTalk", NDPI_PROTOCOL_KAKAOTALK, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { "ttvnw.net", "Twitch", NDPI_PROTOCOL_TWITCH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "static-cdn.jtvnw.net", "Twitch", NDPI_PROTOCOL_TWITCH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "www-cdn.jtvnw.net", "Twitch", NDPI_PROTOCOL_TWITCH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "quickplay.com", "QuickPlay", NDPI_PROTOCOL_QUICKPLAY, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".qq.com", "QQ", NDPI_PROTOCOL_QQ, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".gtimg.com", "QQ", NDPI_PROTOCOL_QQ, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".weibo.com", "Sina(Weibo)", NDPI_PROTOCOL_SINA, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".sinaimg.cn", "Sina", NDPI_PROTOCOL_SINA, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".sinajs.cn", "Sina", NDPI_PROTOCOL_SINA, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".sina.cn", "Sina", NDPI_PROTOCOL_SINA, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".sina.com.cn", "Sina", NDPI_PROTOCOL_SINA, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, /* https://support.cipafilter.com/index.php?/Knowledgebase/Article/View/117/0/snapchat---how-to-block */ { "feelinsonice.appspot.com", "Snapchat", NDPI_PROTOCOL_SNAPCHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { "feelinsonice-hrd.appspot.com", "Snapchat", NDPI_PROTOCOL_SNAPCHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { "feelinsonice.com", "Snapchat", NDPI_PROTOCOL_SNAPCHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".snapchat.", "Snapchat", NDPI_PROTOCOL_SNAPCHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".snapads.", "Snapchat", NDPI_PROTOCOL_SNAPCHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, /* Detected "instagram.c10r.facebook.com". Omitted "*amazonaws.com" and "*facebook.com" CDNs e.g. "ig-telegraph-shv-04-frc3.facebook.com" */ { ".cdninstagram.com", "Instagram", NDPI_PROTOCOL_INSTAGRAM, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "instagram.", "Instagram", NDPI_PROTOCOL_INSTAGRAM, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".instagram.", "Instagram", NDPI_PROTOCOL_INSTAGRAM, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "igcdn-photos-", "Instagram", NDPI_PROTOCOL_INSTAGRAM, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "instagramimages-", "Instagram", NDPI_PROTOCOL_INSTAGRAM, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { "instagramstatic-", "Instagram", NDPI_PROTOCOL_INSTAGRAM, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".waze.com", "Waze", NDPI_PROTOCOL_WAZE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { ".deezer.com", "Deezer", NDPI_PROTOCOL_DEEZER, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".microsoft.com", "Microsoft", NDPI_PROTOCOL_MICROSOFT, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { "i-msdn.sec.s-msft.com", "Microsoft", NDPI_PROTOCOL_MICROSOFT, NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, NDPI_PROTOCOL_ACCEPTABLE }, { "i2-msdn.sec.s-msft.com", "Microsoft", NDPI_PROTOCOL_MICROSOFT, NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, NDPI_PROTOCOL_ACCEPTABLE }, { ".webtrends.com", "Microsoft", NDPI_PROTOCOL_MICROSOFT, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { ".msecnd.net", "Microsoft", NDPI_PROTOCOL_MICROSOFT, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "bing.com", "Microsoft", NDPI_PROTOCOL_MICROSOFT, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_SAFE }, { ".visualstudio.com", "Microsoft", NDPI_PROTOCOL_MICROSOFT, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_SAFE }, { "bn1301.storage.live.com", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE,NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { "*.gateway.messenger.live.com", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { "skyapi.live.net", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { "d.docs.live.net", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE }, { "update.microsoft.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { ".windowsupdate.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_SAFE }, { "worldofwarcraft.com", "WorldOfWarcraft", NDPI_PROTOCOL_WORLDOFWARCRAFT, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".anchorfree.", "HotspotShield", NDPI_PROTOCOL_HOTSPOT_SHIELD, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS }, { "hotspotshield.com", "HotspotShield", NDPI_PROTOCOL_HOTSPOT_SHIELD, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS }, { ".webex.com", "Webex", NDPI_PROTOCOL_WEBEX, NDPI_PROTOCOL_CATEGORY_VOIP, NDPI_PROTOCOL_ACCEPTABLE }, { ".ocsdomain.com", "OCS", NDPI_PROTOCOL_OCS, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "ocs.fr", "OCS", NDPI_PROTOCOL_OCS, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".ocs.fr", "OCS", NDPI_PROTOCOL_OCS, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".labgency.ws", "OCS", NDPI_PROTOCOL_OCS, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".iflix.com", "IFLIX", NDPI_PROTOCOL_IFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".app.iflixcorp.com", "IFLIX", NDPI_PROTOCOL_IFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".images.iflixassets.com", "IFLIX", NDPI_PROTOCOL_IFLIX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "crl.microsoft.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "evsecure-ocsp.verisign.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "evsecure-aia.verisign.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "evsecure-crl.verisign.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".omniroot.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".microsoftonline.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".office365.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".office.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".msocsp.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".msocdn.com", "Office365", NDPI_PROTOCOL_OFFICE_365, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, /* http://www.urlquery.net/report.php?id=1453233646161 */ { "lifedom.top", "Cloudflare", NDPI_PROTOCOL_CLOUDFLARE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "coby.ns.cloudflare.com", "Cloudflare", NDPI_PROTOCOL_CLOUDFLARE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "amanda.ns.cloudflare.com", "Cloudflare", NDPI_PROTOCOL_CLOUDFLARE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { "d295hzzivaok4k.cloudfront.net","OpenDNS", NDPI_PROTOCOL_OPENDNS, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE }, { ".opendns.com", "OpenDNS", NDPI_PROTOCOL_OPENDNS, NDPI_PROTOCOL_CATEGORY_NETWORK, NDPI_PROTOCOL_ACCEPTABLE }, /* https://get.slack.help/hc/en-us/articles/205138367-Troubleshooting-Slack-connection-issues */ { "slack.com", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".slack-msgs.com", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "slack-files.com", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "slack-imgs.com", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".slack-edge.com", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".slack-core.com", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "slack-redir.net", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, /* Detected "slack-assets2.s3-us-west-2.amazonaws.com.". Omitted "*amazonaws.com" CDN, but no generic pattern to use on first part */ { "slack-assets2.s3-", "Slack", NDPI_PROTOCOL_SLACK, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "github.com", "Github", NDPI_PROTOCOL_GITHUB, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".github.com", "Github", NDPI_PROTOCOL_GITHUB, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "github.io", "Github", NDPI_PROTOCOL_GITHUB, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".github.io", "Github", NDPI_PROTOCOL_GITHUB, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { "githubusercontent.com", "Github", NDPI_PROTOCOL_GITHUB, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".githubusercontent.com", "Github", NDPI_PROTOCOL_GITHUB, NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, NDPI_PROTOCOL_ACCEPTABLE }, { ".iqiyi.com", "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".qiyi.com", "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".71.am", "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".qiyipic.com", "iQIYI", NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".ppstream.com", "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".pps.tv", "PPStream", NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".1kxun.", "1kxun", NDPI_PROTOCOL_1KXUN, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "tcad.wedolook.com", "1kxun", NDPI_PROTOCOL_1KXUN, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".steampowered.com", "Steam", NDPI_PROTOCOL_STEAM, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { "steamcommunity.com", "Steam", NDPI_PROTOCOL_STEAM, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".steamcontent.com", "Steam", NDPI_PROTOCOL_STEAM, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".steamstatic.com", "Steam", NDPI_PROTOCOL_STEAM, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { "steamcommunity-a.akamaihd.net","Steam", NDPI_PROTOCOL_STEAM, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".wechat.com", "WeChat", NDPI_PROTOCOL_WECHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".wechat.org", "WeChat", NDPI_PROTOCOL_WECHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".wechatapp.com", "WeChat", NDPI_PROTOCOL_WECHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".we.chat", "WeChat", NDPI_PROTOCOL_WECHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".wx.", "WeChat", NDPI_PROTOCOL_WECHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".weixin.", "WeChat", NDPI_PROTOCOL_WECHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { ".mmsns.qpic.cn", "WeChat", NDPI_PROTOCOL_WECHAT, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_FUN }, { "dnscrypt.org", "DNScrypt", NDPI_PROTOCOL_DNSCRYPT, NDPI_PROTOCOL_CATEGORY_NETWORK, NDPI_PROTOCOL_ACCEPTABLE }, { "torrent.", "BitTorrent", NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_UNSAFE }, { "torrents.", "BitTorrent", NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_UNSAFE }, { "torrentz.", "BitTorrent", NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_UNSAFE }, { ".nintendo.net", "Nintendo", NDPI_PROTOCOL_NINTENDO, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".nintendo.com", "Nintendo", NDPI_PROTOCOL_NINTENDO, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".playstation.net", "Playstation", NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".playstation.com", "Playstation", NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".sonyentertainmentnetwork.com","Playstation", NDPI_PROTOCOL_PLAYSTATION, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN }, { ".pastebin.com", "Pastebin", NDPI_PROTOCOL_PASTEBIN, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS }, { ".linkedin.com", "LinkedIn", NDPI_PROTOCOL_LINKEDIN, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".licdn.com", "LinkedIn", NDPI_PROTOCOL_LINKEDIN, NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, NDPI_PROTOCOL_FUN }, { ".sndcdn.com", "SoundCloud", NDPI_PROTOCOL_SOUNDCLOUD, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".soundcloud.com", "SoundCloud", NDPI_PROTOCOL_SOUNDCLOUD, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "getrockerbox.com", "SoundCloud", NDPI_PROTOCOL_SOUNDCLOUD, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "web.telegram.org", "Telegram", NDPI_PROTOCOL_TELEGRAM, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { "tdesktop.com", "Telegram", NDPI_PROTOCOL_TELEGRAM, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { "tupdate.com", "Telegram", NDPI_PROTOCOL_TELEGRAM, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { ".icq.", "ICQ", NDPI_PROTOCOL_ICQ, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { "icq.", "ICQ", NDPI_PROTOCOL_ICQ, NDPI_PROTOCOL_CATEGORY_CHAT, NDPI_PROTOCOL_ACCEPTABLE }, { NULL, 0 } }; /* Mime-type content match match */ ndpi_protocol_match content_match[] = { { "audio/mpeg", NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "audio/x-mpeg", NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "audio/mpeg3", NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "audio/mp4a", NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/mpeg", NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/nsv", NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "misc/ultravox", NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "audio/ogg", NULL, NDPI_CONTENT_OGG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/ogg", NULL, NDPI_CONTENT_OGG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/ogg", NULL, NDPI_CONTENT_OGG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { ".adobe.", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/flv", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/x-flv", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/x-fcs", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/x-shockwave-flash",NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_ACCEPTABLE }, { "video/flash", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/flv", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "flv-application/octet-stream", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/futuresplash", NULL, NDPI_CONTENT_FLASH, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/quicktime", NULL, NDPI_CONTENT_QUICKTIME, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/mp4", NULL, NDPI_CONTENT_QUICKTIME, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/x-m4v", NULL, NDPI_CONTENT_QUICKTIME, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "audio/x-pn-realaudio", NULL, NDPI_CONTENT_REALMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/vnd.rn-realmedia", NULL, NDPI_CONTENT_REALMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/x-ms-", NULL, NDPI_CONTENT_WINDOWSMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "asf", NULL, NDPI_CONTENT_WINDOWSMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "asx", NULL, NDPI_CONTENT_WINDOWSMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/x-msvideo", NULL, NDPI_CONTENT_WINDOWSMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "audio/x-wav", NULL, NDPI_CONTENT_WINDOWSMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/vnd.ms.wms-hdr.asfv1", NULL, NDPI_CONTENT_WINDOWSMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "NSPlayer/", NULL, NDPI_CONTENT_WINDOWSMEDIA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/x-mms-framed", NULL, NDPI_CONTENT_MMS, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "Xbox Live Client/", NULL, NDPI_PROTOCOL_XBOX, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "Windows-Update-Agent", NULL, NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_ACCEPTABLE }, { "audio/webm", NULL, NDPI_CONTENT_WEBM, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "video/webm", NULL, NDPI_CONTENT_WEBM, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/x-rtsp-tunnelled", NULL, NDPI_PROTOCOL_RTSP, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/vnd.apple.mpegurl",NULL, NDPI_CONTENT_MPEG, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN }, { "application/x-tar", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "application/octet-stream", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "application/mac-binary", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "/x-bzip", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "/x-gzip", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "/x-zip", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "/zip", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "binhex", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "/base64", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "application/gnutar", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { "application/x-compressed", NULL, NDPI_PROTOCOL_HTTP_DOWNLOAD, NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, NDPI_PROTOCOL_ACCEPTABLE }, { NULL, 0 } }; /* ****************************************************** */ /* Tor The tor protocol uses SSL to contact peers so it could be exchanged with standard SSL. However the host names such as - www.fgd2iwya7vinfutj5wq5we.com - www.qbtxzhetq4s2f.com - www.fgd2iwya7vinfutj5wq5we.net See also DGA (Domain Generation Algorithm) In essence www..com|net To do things properly we should check if host name in the certificate exists or if the IP address of the SSL peer resolves to a name. Unfortunately for performance reasons we can't afford to do a DNS lookup in nDPI (however apps can do it if possible) and thus we have created a heuristic algorithm that tries to check the host name (in the SSL certificate) to see if it looks like a random name or a real name. We cannot use a dictionary (how can the kernel read a file?) and this we use bigrams distribution to decide if the string looks like a word or just random chars. http://www3.nd.edu/~busiforc/handouts/cryptography/Letter%20Frequencies.html */ static const char *ndpi_en_bigrams[] = { "aa", "ba", "ca", "da", "ea", "fa", "ga", "ha", "ia", "ja", "ka", "la", "ma", "na", "oa", "pa", "qa", "ra", "sa", "ta", "ua", "va", "wa", "xa", "ya", "za", "ab", "bb", "db", "eb", "fb", "gb", "hb", "ib", "kb", "lb", "mb", "nb", "ob", "pb", "rb", "sb", "tb", "ub", "wb", "yb", "ac", "bc", "cc", "dc", "ec", "fc", "gc", "hc", "ic", "kc", "lc", "mc", "nc", "oc", "pc", "rc", "sc", "tc", "uc", "wc", "xc", "yc", "ad", "bd", "cd", "dd", "ed", "fd", "gd", "hd", "id", "kd", "ld", "md", "nd", "od", "pd", "rd", "sd", "td", "ud", "wd", "xd", "yd", "zd", "ae", "be", "ce", "de", "ee", "fe", "ge", "he", "ie", "je", "ke", "le", "me", "ne", "oe", "pe", "re", "se", "te", "ue", "ve", "we", "xe", "ye", "ze", "af", "bf", "df", "ef", "ff", "gf", "hf", "if", "kf", "lf", "mf", "nf", "of", "pf", "rf", "sf", "tf", "uf", "wf", "xf", "yf", "zf", "ag", "bg", "dg", "eg", "fg", "gg", "hg", "ig", "kg", "lg", "ng", "og", "pg", "rg", "sg", "tg", "ug", "wg", "yg", "ah", "bh", "ch", "dh", "eh", "fh", "gh", "hh", "ih", "kh", "lh", "mh", "nh", "oh", "ph", "rh", "sh", "th", "uh", "wh", "xh", "yh", "ai", "bi", "ci", "di", "ei", "fi", "gi", "hi", "ii", "ji", "ki", "li", "mi", "ni", "oi", "pi", "qi", "ri", "si", "ti", "ui", "vi", "wi", "xi", "yi", "zi", "aj", "bj", "dj", "ej", "fj", "gj", "hj", "ij", "jj", "kj", "lj", "nj", "oj", "pj", "rj", "sj", "tj", "uj", "wj", "yj", "ak", "ck", "dk", "ek", "gk", "ik", "kk", "lk", "mk", "nk", "ok", "pk", "rk", "sk", "tk", "uk", "wk", "yk", "zk", "al", "bl", "cl", "dl", "el", "fl", "gl", "hl", "il", "kl", "ll", "ml", "nl", "ol", "pl", "rl", "sl", "tl", "ul", "vl", "wl", "xl", "yl", "zl", "am", "bm", "cm", "dm", "em", "fm", "gm", "hm", "im", "km", "lm", "mm", "nm", "om", "pm", "rm", "sm", "tm", "um", "wm", "xm", "ym", "zm", "an", "bn", "cn", "dn", "en", "fn", "gn", "hn", "in", "kn", "ln", "mn", "nn", "on", "pn", "rn", "sn", "tn", "un", "wn", "xn", "yn", "ao", "bo", "co", "do", "eo", "fo", "go", "ho", "io", "jo", "ko", "lo", "mo", "no", "oo", "po", "ro", "so", "to", "uo", "vo", "wo", "xo", "yo", "zo", "ap", "bp", "dp", "ep", "fp", "gp", "hp", "ip", "kp", "lp", "mp", "np", "op", "pp", "rp", "sp", "tp", "up", "wp", "xp", "yp", "zp", "aq", "cq", "dq", "eq", "hq", "iq", "nq", "oq", "qq", "rq", "sq", "uq", "xq", "ar", "br", "cr", "dr", "er", "fr", "gr", "hr", "ir", "kr", "lr", "mr", "nr", "or", "pr", "rr", "sr", "tr", "ur", "vr", "wr", "xr", "yr", "as", "bs", "cs", "ds", "es", "fs", "gs", "hs", "is", "ks", "ls", "ms", "ns", "os", "ps", "rs", "ss", "ts", "us", "vs", "ws", "xs", "ys", "at", "bt", "ct", "dt", "et", "ft", "gt", "ht", "it", "kt", "lt", "mt", "nt", "ot", "pt", "rt", "st", "tt", "ut", "wt", "xt", "yt", "zt", "au", "bu", "cu", "du", "eu", "fu", "gu", "hu", "iu", "ju", "ku", "lu", "mu", "nu", "ou", "pu", "qu", "ru", "su", "tu", "uu", "vu", "wu", "xu", "yu", "zu", "av", "bv", "dv", "ev", "iv", "lv", "mv", "nv", "ov", "rv", "sv", "tv", "uv", "vv", "zv", "aw", "bw", "dw", "ew", "fw", "gw", "hw", "iw", "kw", "lw", "mw", "nw", "ow", "pw", "rw", "sw", "tw", "uw", "ww", "xw", "yw", "zw", "ax", "ex", "ix", "nx", "ox", "rx", "ux", "xx", "yx", "ay", "by", "cy", "dy", "ey", "fy", "gy", "hy", "ky", "ly", "my", "ny", "oy", "py", "ry", "sy", "ty", "uy", "vy", "wy", "xy", "yy", "zy", "az", "bz", "cz", "dz", "ez", "gz", "iz", "lz", "nz", "oz", "pz", "rz", "tz", "uz", "zz", NULL }; static const char *ndpi_en_impossible_bigrams[] = { "bk", "bq", "bx", "cb", "cf", "cg", "cj", "cp", "cv", "cw", "cx", "dx", "fk", "fq", "fv", "fx", /* "ee", removed it can be found in 'meeting' */ "fz", "gq", "gv", "gx", "hh", "hk", "hv", "hx", "hz", "iy", "jb", "jc", "jd", "jf", "jg", "jh", "jk", "jl", "jm", "jn", "jp", "jq", "jr", /* "js", */ "jt", "jv", "jw", "jx", "jy", "jz", "kg", "kq", "kv", "kx", "kz", "lq", "lx", "mg", "mj", "mq", "mx", "mz", "pq", "pv", "px", "qb", "qc", "qd", "qe", "qf", "ii", "qg", "qh", "qj", "qk", "ql", "qm", "qn", "qo", "qp", "qr", "qs", "qt", "qv", "qw", "qx", "qy", "uu", "qz", "sx", "sz", "tq", "tx", "vb", "vc", "vd", "vf", "vg", "vh", "vj", "vm", "vn", "vp", "bw", /* "vk", "zr" Removed for kavkazr */ "vq", "vt", "vw", "vx", "vz", "wq", "wv", "wx", "wz", "xb", "xg", "xj", "xk", "xv", "xz", "xw", "yd", /*"yp", Removed for paypal */ "yj", "yq", "yv", "yz", "yw", "zb", "zc", "zg", "zh", "zj", "zn", "zq", "zs", "zx", "wh", "wk", "wb", "zk", "kp", "zk", "xy", NULL }; nDPI-2.2/src/lib/ndpi_main.c000066400000000000000000006015431321103654100156130ustar00rootroot00000000000000/* * ndpi_main.c * * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include #include #include "ahocorasick.h" #include "ndpi_api.h" #include "../../config.h" #include #ifndef WIN32 #include #endif #include "ndpi_content_match.c.inc" #include "third_party/include/ndpi_patricia.h" #include "third_party/src/ndpi_patricia.c" /* implementation of the punycode check function */ int check_punycode_string(char * buffer , int len) { int i = 0; while(i++ < len) { if( buffer[i] == 'x' && buffer[i+1] == 'n' && buffer[i+2] == '-' && buffer[i+3] == '-' ) // is a punycode string return 1; } // not a punycode string return 0; } /* ftp://ftp.cc.uoc.gr/mirrors/OpenBSD/src/lib/libc/stdlib/tsearch.c */ /* find or insert datum into search tree */ void * ndpi_tsearch(const void *vkey, void **vrootp, int (*compar)(const void *, const void *)) { ndpi_node *q; char *key = (char *)vkey; ndpi_node **rootp = (ndpi_node **)vrootp; if(rootp == (ndpi_node **)0) return ((void *)0); while (*rootp != (ndpi_node *)0) { /* Knuth's T1: */ int r; if((r = (*compar)(key, (*rootp)->key)) == 0) /* T2: */ return ((void *)*rootp); /* we found it! */ rootp = (r < 0) ? &(*rootp)->left : /* T3: follow left branch */ &(*rootp)->right; /* T4: follow right branch */ } q = (ndpi_node *) ndpi_malloc(sizeof(ndpi_node)); /* T5: key not found */ if(q != (ndpi_node *)0) { /* make new node */ *rootp = q; /* link new node to old */ q->key = key; /* initialize new node */ q->left = q->right = (ndpi_node *)0; } return ((void *)q); } /* delete node with given key */ void * ndpi_tdelete(const void *vkey, void **vrootp, int (*compar)(const void *, const void *)) { ndpi_node **rootp = (ndpi_node **)vrootp; char *key = (char *)vkey; ndpi_node *p = (ndpi_node *)1; ndpi_node *q; ndpi_node *r; int cmp; if(rootp == (ndpi_node **)0 || *rootp == (ndpi_node *)0) return ((ndpi_node *)0); while ((cmp = (*compar)(key, (*rootp)->key)) != 0) { p = *rootp; rootp = (cmp < 0) ? &(*rootp)->left : /* follow left branch */ &(*rootp)->right; /* follow right branch */ if(*rootp == (ndpi_node *)0) return ((void *)0); /* key not found */ } r = (*rootp)->right; /* D1: */ if((q = (*rootp)->left) == (ndpi_node *)0) /* Left (ndpi_node *)0? */ q = r; else if(r != (ndpi_node *)0) { /* Right link is null? */ if(r->left == (ndpi_node *)0) { /* D2: Find successor */ r->left = q; q = r; } else { /* D3: Find (ndpi_node *)0 link */ for(q = r->left; q->left != (ndpi_node *)0; q = r->left) r = q; r->left = q->right; q->left = (*rootp)->left; q->right = (*rootp)->right; } } ndpi_free((ndpi_node *) *rootp); /* D4: Free node */ *rootp = q; /* link parent to new node */ return(p); } /* Walk the nodes of a tree */ static void ndpi_trecurse(ndpi_node *root, void (*action)(const void *, ndpi_VISIT, int, void*), int level, void *user_data) { if(root->left == (ndpi_node *)0 && root->right == (ndpi_node *)0) (*action)(root, ndpi_leaf, level, user_data); else { (*action)(root, ndpi_preorder, level, user_data); if(root->left != (ndpi_node *)0) ndpi_trecurse(root->left, action, level + 1, user_data); (*action)(root, ndpi_postorder, level, user_data); if(root->right != (ndpi_node *)0) ndpi_trecurse(root->right, action, level + 1, user_data); (*action)(root, ndpi_endorder, level, user_data); } } /* Walk the nodes of a tree */ void ndpi_twalk(const void *vroot, void (*action)(const void *, ndpi_VISIT, int, void *), void *user_data) { ndpi_node *root = (ndpi_node *)vroot; if(root != (ndpi_node *)0 && action != (void (*)(const void *, ndpi_VISIT, int, void*))0) ndpi_trecurse(root, action, 0, user_data); } /* find a node, or return 0 */ void * ndpi_tfind(const void *vkey, void *vrootp, int (*compar)(const void *, const void *)) { char *key = (char *)vkey; ndpi_node **rootp = (ndpi_node **)vrootp; if(rootp == (ndpi_node **)0) return ((ndpi_node *)0); while (*rootp != (ndpi_node *)0) { /* T1: */ int r; if((r = (*compar)(key, (*rootp)->key)) == 0) /* T2: */ return (*rootp); /* key found */ rootp = (r < 0) ? &(*rootp)->left : /* T3: follow left branch */ &(*rootp)->right; /* T4: follow right branch */ } return (ndpi_node *)0; } /* ****************************************** */ /* Walk the nodes of a tree */ static void ndpi_tdestroy_recurse(ndpi_node* root, void (*free_action)(void *)) { if(root->left != NULL) ndpi_tdestroy_recurse(root->left, free_action); if(root->right != NULL) ndpi_tdestroy_recurse(root->right, free_action); (*free_action) ((void *) root->key); ndpi_free(root); } void ndpi_tdestroy(void *vrootp, void (*freefct)(void *)) { ndpi_node *root = (ndpi_node *) vrootp; if(root != NULL) ndpi_tdestroy_recurse(root, freefct); } /* ****************************************** */ u_int8_t ndpi_net_match(u_int32_t ip_to_check, u_int32_t net, u_int32_t num_bits) { u_int32_t mask = 0; mask = ~(~mask >> num_bits); return(((ip_to_check & mask) == (net & mask)) ? 1 : 0); } u_int8_t ndpi_ips_match(u_int32_t src, u_int32_t dst, u_int32_t net, u_int32_t num_bits) { return(ndpi_net_match(src, net, num_bits) || ndpi_net_match(dst, net, num_bits)); } /* ****************************************** */ static void *(*_ndpi_flow_malloc)(size_t size); static void (*_ndpi_flow_free)(void *ptr); static void *(*_ndpi_malloc)(size_t size); static void (*_ndpi_free)(void *ptr); /* ****************************************** */ #ifdef WIN32 /* http://opensource.apple.com/source/Libc/Libc-186/string.subproj/strcasecmp.c */ /* * This array is designed for mapping upper and lower case letter * together for a case independent comparison. The mappings are * based upon ascii character sequences. */ static const u_char charmap[] = { '\000', '\001', '\002', '\003', '\004', '\005', '\006', '\007', '\010', '\011', '\012', '\013', '\014', '\015', '\016', '\017', '\020', '\021', '\022', '\023', '\024', '\025', '\026', '\027', '\030', '\031', '\032', '\033', '\034', '\035', '\036', '\037', '\040', '\041', '\042', '\043', '\044', '\045', '\046', '\047', '\050', '\051', '\052', '\053', '\054', '\055', '\056', '\057', '\060', '\061', '\062', '\063', '\064', '\065', '\066', '\067', '\070', '\071', '\072', '\073', '\074', '\075', '\076', '\077', '\100', '\141', '\142', '\143', '\144', '\145', '\146', '\147', '\150', '\151', '\152', '\153', '\154', '\155', '\156', '\157', '\160', '\161', '\162', '\163', '\164', '\165', '\166', '\167', '\170', '\171', '\172', '\133', '\134', '\135', '\136', '\137', '\140', '\141', '\142', '\143', '\144', '\145', '\146', '\147', '\150', '\151', '\152', '\153', '\154', '\155', '\156', '\157', '\160', '\161', '\162', '\163', '\164', '\165', '\166', '\167', '\170', '\171', '\172', '\173', '\174', '\175', '\176', '\177', '\200', '\201', '\202', '\203', '\204', '\205', '\206', '\207', '\210', '\211', '\212', '\213', '\214', '\215', '\216', '\217', '\220', '\221', '\222', '\223', '\224', '\225', '\226', '\227', '\230', '\231', '\232', '\233', '\234', '\235', '\236', '\237', '\240', '\241', '\242', '\243', '\244', '\245', '\246', '\247', '\250', '\251', '\252', '\253', '\254', '\255', '\256', '\257', '\260', '\261', '\262', '\263', '\264', '\265', '\266', '\267', '\270', '\271', '\272', '\273', '\274', '\275', '\276', '\277', '\300', '\301', '\302', '\303', '\304', '\305', '\306', '\307', '\310', '\311', '\312', '\313', '\314', '\315', '\316', '\317', '\320', '\321', '\322', '\323', '\324', '\325', '\326', '\327', '\330', '\331', '\332', '\333', '\334', '\335', '\336', '\337', '\340', '\341', '\342', '\343', '\344', '\345', '\346', '\347', '\350', '\351', '\352', '\353', '\354', '\355', '\356', '\357', '\360', '\361', '\362', '\363', '\364', '\365', '\366', '\367', '\370', '\371', '\372', '\373', '\374', '\375', '\376', '\377', }; int strcasecmp(s1, s2) const char *s1, *s2; { register const u_char *cm = charmap, *us1 = (const u_char *)s1, *us2 = (const u_char *)s2; while (cm[*us1] == cm[*us2++]) if(*us1++ == '\0') return (0); return (cm[*us1] - cm[*--us2]); } int strncasecmp(s1, s2, n) const char *s1, *s2; register size_t n; { if(n != 0) { register const u_char *cm = charmap, *us1 = (const u_char *)s1, *us2 = (const u_char *)s2; do { if(cm[*us1] != cm[*us2++]) return (cm[*us1] - cm[*--us2]); if(*us1++ == '\0') break; } while (--n != 0); } return (0); } #endif /* ****************************************** */ /* Forward */ static void addDefaultPort(ndpi_port_range *range, ndpi_proto_defaults_t *def, u_int8_t customUserProto, ndpi_default_ports_tree_node_t **root); static int removeDefaultPort(ndpi_port_range *range, ndpi_proto_defaults_t *def, ndpi_default_ports_tree_node_t **root); /* ****************************************** */ void * ndpi_malloc(size_t size) { return(_ndpi_malloc ? _ndpi_malloc(size) : malloc(size)); } void * ndpi_flow_malloc(size_t size) { return(_ndpi_flow_malloc ? _ndpi_flow_malloc(size) : ndpi_malloc(size)); } /* ****************************************** */ void * ndpi_calloc(unsigned long count, size_t size) { size_t len = count*size; void *p = ndpi_malloc(len); if(p) memset(p, 0, len); return(p); } /* ****************************************** */ void ndpi_free(void *ptr) { if(_ndpi_free) _ndpi_free(ptr); else free(ptr); } void ndpi_flow_free(void *ptr) { if(_ndpi_flow_free) _ndpi_flow_free(ptr); else ndpi_free_flow((struct ndpi_flow_struct *) ptr); } /* ****************************************** */ void * ndpi_realloc(void *ptr, size_t old_size, size_t new_size) { void *ret = ndpi_malloc(new_size); if(!ret) return(ret); else { memcpy(ret, ptr, old_size); ndpi_free(ptr); return(ret); } } /* ****************************************** */ char * ndpi_strdup(const char *s) { int len = strlen(s); char *m = ndpi_malloc(len+1); if(m) { memcpy(m, s, len); m[len] = '\0'; } return(m); } /* *********************************************************************************** */ u_int32_t ndpi_detection_get_sizeof_ndpi_flow_struct(void) { return sizeof(struct ndpi_flow_struct); } /* *********************************************************************************** */ u_int32_t ndpi_detection_get_sizeof_ndpi_id_struct(void) { return sizeof(struct ndpi_id_struct); } /* *********************************************************************************** */ char * ndpi_get_proto_by_id(struct ndpi_detection_module_struct *ndpi_mod, u_int id) { return((id >= ndpi_mod->ndpi_num_supported_protocols) ? NULL : ndpi_mod->proto_defaults[id].protoName); } /* *********************************************************************************** */ u_int16_t ndpi_get_proto_by_name(struct ndpi_detection_module_struct *ndpi_mod, const char *name) { u_int16_t i, num = ndpi_get_num_supported_protocols(ndpi_mod); for(i = 0; i < num; i++) if(strcasecmp(ndpi_get_proto_by_id(ndpi_mod, i), name) == 0) return(i); return(NDPI_PROTOCOL_UNKNOWN); } /* ************************************************************************************* */ ndpi_port_range * ndpi_build_default_ports_range(ndpi_port_range *ports, u_int16_t portA_low, u_int16_t portA_high, u_int16_t portB_low, u_int16_t portB_high, u_int16_t portC_low, u_int16_t portC_high, u_int16_t portD_low, u_int16_t portD_high, u_int16_t portE_low, u_int16_t portE_high) { int i = 0; ports[i].port_low = portA_low, ports[i].port_high = portA_high; i++; ports[i].port_low = portB_low, ports[i].port_high = portB_high; i++; ports[i].port_low = portC_low, ports[i].port_high = portC_high; i++; ports[i].port_low = portD_low, ports[i].port_high = portD_high; i++; ports[i].port_low = portE_low, ports[i].port_high = portE_high; i++; return(ports); } /* *********************************************************************************** */ ndpi_port_range * ndpi_build_default_ports(ndpi_port_range *ports, u_int16_t portA, u_int16_t portB, u_int16_t portC, u_int16_t portD, u_int16_t portE) { int i = 0; ports[i].port_low = portA, ports[i].port_high = portA; i++; ports[i].port_low = portB, ports[i].port_high = portB; i++; ports[i].port_low = portC, ports[i].port_high = portC; i++; ports[i].port_low = portD, ports[i].port_high = portD; i++; ports[i].port_low = portE, ports[i].port_high = portE; i++; return(ports); } /* ********************************************************************************** */ void ndpi_set_proto_breed(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t protoId, ndpi_protocol_breed_t breed) { if(protoId >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) return; else ndpi_mod->proto_defaults[protoId].protoBreed = breed; } /* ********************************************************************************** */ void ndpi_set_proto_category(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t protoId, ndpi_protocol_category_t protoCategory) { if(protoId >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) return; else ndpi_mod->proto_defaults[protoId].protoCategory = protoCategory; } /* ********************************************************************************** */ /* There are some (master) protocols that are informative, meaning that it shows what is the subprotocol about, but also that the subprotocol isn't a real protocol. Example: - DNS is informative as if we see a DNS request for www.facebook.com, the returned protocol is DNS.Facebook, but Facebook isn't a real subprotocol but rather it indicates a query for Facebook and not Facebook traffic. - HTTP/SSL are NOT informative as SSL.Facebook (likely) means that this is SSL (HTTPS) traffic containg Facebook traffic. */ u_int8_t ndpi_is_subprotocol_informative(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t protoId) { if(protoId >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) return(0); switch(protoId) { case NDPI_PROTOCOL_DNS: return(1); break; default: return(0); } } /* ********************************************************************************** */ void ndpi_set_proto_defaults(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_breed_t breed, u_int16_t protoId, u_int16_t tcp_master_protoId[2], u_int16_t udp_master_protoId[2], char *protoName, ndpi_protocol_category_t protoCategory, ndpi_port_range *tcpDefPorts, ndpi_port_range *udpDefPorts) { char *name; int j; if(protoId >= NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS) { #ifdef DEBUG printf("[NDPI] %s(%s/protoId=%d): INTERNAL ERROR\n", __FUNCTION__, protoName, protoId); #endif return; } if(ndpi_mod->proto_defaults[protoId].protoName != NULL) { #ifdef DEBUG printf("[NDPI] %s(%s/protoId=%d): already initialized. Ignoring it\n", __FUNCTION__, protoName, protoId); #endif return; } name = ndpi_strdup(protoName); ndpi_mod->proto_defaults[protoId].protoName = name, ndpi_mod->proto_defaults[protoId].protoCategory = protoCategory, ndpi_mod->proto_defaults[protoId].protoId = protoId, ndpi_mod->proto_defaults[protoId].protoBreed = breed; memcpy(&ndpi_mod->proto_defaults[protoId].master_tcp_protoId, tcp_master_protoId, 2*sizeof(u_int16_t)); memcpy(&ndpi_mod->proto_defaults[protoId].master_udp_protoId, udp_master_protoId, 2*sizeof(u_int16_t)); for(j=0; jproto_defaults[protoId], 0, &ndpi_mod->udpRoot); if(tcpDefPorts[j].port_low != 0) addDefaultPort(&tcpDefPorts[j], &ndpi_mod->proto_defaults[protoId], 0, &ndpi_mod->tcpRoot); } } /* ******************************************************************** */ static int ndpi_default_ports_tree_node_t_cmp(const void *a, const void *b) { ndpi_default_ports_tree_node_t *fa = (ndpi_default_ports_tree_node_t*)a; ndpi_default_ports_tree_node_t *fb = (ndpi_default_ports_tree_node_t*)b; //printf("[NDPI] %s(%d, %d)\n", __FUNCTION__, fa->default_port, fb->default_port); return((fa->default_port == fb->default_port) ? 0 : ((fa->default_port < fb->default_port) ? -1 : 1)); } /* ******************************************************************** */ void ndpi_default_ports_tree_node_t_walker(const void *node, const ndpi_VISIT which, const int depth) { ndpi_default_ports_tree_node_t *f = *(ndpi_default_ports_tree_node_t **)node; printf("<%d>Walk on node %s (%u)\n", depth, which == ndpi_preorder?"ndpi_preorder": which == ndpi_postorder?"ndpi_postorder": which == ndpi_endorder?"ndpi_endorder": which == ndpi_leaf?"ndpi_leaf": "unknown", f->default_port); } /* ******************************************************************** */ static void addDefaultPort(ndpi_port_range *range, ndpi_proto_defaults_t *def, u_int8_t customUserProto, ndpi_default_ports_tree_node_t **root) { ndpi_default_ports_tree_node_t *ret; u_int16_t port; for(port=range->port_low; port<=range->port_high; port++) { ndpi_default_ports_tree_node_t *node = (ndpi_default_ports_tree_node_t*)ndpi_malloc(sizeof(ndpi_default_ports_tree_node_t)); if(!node) { printf("[NDPI] %s(): not enough memory\n", __FUNCTION__); break; } node->proto = def, node->default_port = port, node->customUserProto = customUserProto; ret = *(ndpi_default_ports_tree_node_t**)ndpi_tsearch(node, (void*)root, ndpi_default_ports_tree_node_t_cmp); /* Add it to the tree */ if(ret != node) { /* printf("[NDPI] %s(): found duplicate for port %u: overwriting it with new value\n", __FUNCTION__, port); */ ret->proto = def; ndpi_free(node); } } } /* ****************************************************** */ /* NOTE This function must be called with a semaphore set, this in order to avoid changing the datastructures while using them */ static int removeDefaultPort(ndpi_port_range *range, ndpi_proto_defaults_t *def, ndpi_default_ports_tree_node_t **root) { ndpi_default_ports_tree_node_t node; ndpi_default_ports_tree_node_t *ret; u_int16_t port; for(port=range->port_low; port<=range->port_high; port++) { node.proto = def, node.default_port = port; ret = *(ndpi_default_ports_tree_node_t**)ndpi_tdelete(&node, (void*)root, ndpi_default_ports_tree_node_t_cmp); /* Add it to the tree */ if(ret != NULL) { ndpi_free((ndpi_default_ports_tree_node_t*)ret); return(0); } } return(-1); } /* ****************************************************** */ static int ndpi_string_to_automa(struct ndpi_detection_module_struct *ndpi_struct, ndpi_automa *automa, char *value, int protocol_id, ndpi_protocol_breed_t breed) { AC_PATTERN_t ac_pattern; if(protocol_id >= (NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS)) { printf("[NDPI] %s(protoId=%d): INTERNAL ERROR\n", __FUNCTION__, protocol_id); return(-1); } if(automa->ac_automa == NULL) return(-2); ac_pattern.astring = value; ac_pattern.rep.number = protocol_id; if(value == NULL) ac_pattern.length = 0; else ac_pattern.length = strlen(ac_pattern.astring); ac_automata_add(((AC_AUTOMATA_t*)automa->ac_automa), &ac_pattern); return(0); } /* ****************************************************** */ static int ndpi_add_host_url_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, char *value, int protocol_id, ndpi_protocol_breed_t breed) { #ifdef DEBUG printf("[NDPI] Adding [%s][%d]\n", value, protocol_id); #endif return(ndpi_string_to_automa(ndpi_struct, &ndpi_struct->host_automa, value, protocol_id, breed)); } /* ****************************************************** */ int ndpi_add_content_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, char *value, int protocol_id, ndpi_protocol_breed_t breed) { return(ndpi_string_to_automa(ndpi_struct, &ndpi_struct->content_automa, value, protocol_id, breed)); } /* ****************************************************** */ /* NOTE This function must be called with a semaphore set, this in order to avoid changing the datastructures while using them */ static int ndpi_remove_host_url_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, char *value, int protocol_id) { printf("[NDPI] Missing implementation of %s()\n", __FUNCTION__); return(-1); } /* ******************************************************************** */ void ndpi_init_protocol_match(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_match *match) { u_int16_t no_master[2] = { NDPI_PROTOCOL_NO_MASTER_PROTO, NDPI_PROTOCOL_NO_MASTER_PROTO }; ndpi_port_range ports_a[MAX_DEFAULT_PORTS], ports_b[MAX_DEFAULT_PORTS]; ndpi_add_host_url_subprotocol(ndpi_mod, match->string_to_match, match->protocol_id, match->protocol_breed); if(ndpi_mod->proto_defaults[match->protocol_id].protoName == NULL) { ndpi_mod->proto_defaults[match->protocol_id].protoName = ndpi_strdup(match->proto_name); ndpi_mod->proto_defaults[match->protocol_id].protoCategory = match->proto_category; ndpi_mod->proto_defaults[match->protocol_id].protoId = match->protocol_id; ndpi_mod->proto_defaults[match->protocol_id].protoBreed = match->protocol_breed; } ndpi_set_proto_defaults(ndpi_mod, ndpi_mod->proto_defaults[match->protocol_id].protoBreed, ndpi_mod->proto_defaults[match->protocol_id].protoId, no_master, no_master, ndpi_mod->proto_defaults[match->protocol_id].protoName, ndpi_mod->proto_defaults[match->protocol_id].protoCategory, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); } /* ******************************************************************** */ static void init_string_based_protocols(struct ndpi_detection_module_struct *ndpi_mod) { int i; for(i=0; host_match[i].string_to_match != NULL; i++) ndpi_init_protocol_match(ndpi_mod, &host_match[i]); #ifdef DEBUG ac_automata_display(ndpi_mod->host_automa.ac_automa, 'n'); #endif for(i=0; content_match[i].string_to_match != NULL; i++) ndpi_add_content_subprotocol(ndpi_mod, content_match[i].string_to_match, content_match[i].protocol_id, content_match[i].protocol_breed); for(i=0; ndpi_en_bigrams[i] != NULL; i++) ndpi_string_to_automa(ndpi_mod, &ndpi_mod->bigrams_automa, (char*)ndpi_en_bigrams[i], 1, NDPI_PROTOCOL_UNRATED); for(i=0; ndpi_en_impossible_bigrams[i] != NULL; i++) ndpi_string_to_automa(ndpi_mod, &ndpi_mod->impossible_bigrams_automa, (char*)ndpi_en_impossible_bigrams[i], 1, NDPI_PROTOCOL_UNRATED); } /* ******************************************************************** */ /* This function is used to map protocol name and default ports and it MUST be updated whenever a new protocol is added to NDPI. Do NOT add web services (NDPI_SERVICE_xxx) here. */ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndpi_mod) { int i; ndpi_port_range ports_a[MAX_DEFAULT_PORTS], ports_b[MAX_DEFAULT_PORTS]; u_int16_t no_master[2] = { NDPI_PROTOCOL_NO_MASTER_PROTO, NDPI_PROTOCOL_NO_MASTER_PROTO }, custom_master[2]; /* Reset all settings */ memset(ndpi_mod->proto_defaults, 0, sizeof(ndpi_mod->proto_defaults)); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNRATED, NDPI_PROTOCOL_UNKNOWN, no_master, no_master, "Unknown", NDPI_PROTOCOL_CATEGORY_UNSPECIFIED, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNSAFE, NDPI_PROTOCOL_FTP_CONTROL, no_master, no_master, "FTP_CONTROL", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 21, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_FTP_DATA, no_master, no_master, "FTP_DATA", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 20, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNSAFE, NDPI_PROTOCOL_MAIL_POP, no_master, no_master, "POP3", NDPI_PROTOCOL_CATEGORY_MAIL, ndpi_build_default_ports(ports_a, 110, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_MAIL_POPS, no_master, no_master, "POPS", NDPI_PROTOCOL_CATEGORY_MAIL, ndpi_build_default_ports(ports_a, 995, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MAIL_SMTP, no_master, no_master, "SMTP", NDPI_PROTOCOL_CATEGORY_MAIL, ndpi_build_default_ports(ports_a, 25, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_MAIL_SMTPS, no_master, no_master, "SMTPS", NDPI_PROTOCOL_CATEGORY_MAIL, ndpi_build_default_ports(ports_a, 465, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNSAFE, NDPI_PROTOCOL_MAIL_IMAP, no_master, no_master, "IMAP", NDPI_PROTOCOL_CATEGORY_MAIL, ndpi_build_default_ports(ports_a, 143, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_MAIL_IMAPS, no_master, no_master, "IMAPS", NDPI_PROTOCOL_CATEGORY_MAIL, ndpi_build_default_ports(ports_a, 993, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DNS, no_master, no_master, "DNS", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 53, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 53, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IPP, no_master, no_master, "IPP", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HEP, no_master, no_master, "HEP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 9064, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 9063, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HTTP, no_master, no_master, "HTTP", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 80, 0 /* ntop */, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MDNS, no_master, no_master, "MDNS", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 5353, 5354, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_NTP, no_master, no_master, "NTP", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 123, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_NETBIOS, no_master, no_master, "NetBIOS", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 139, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 137, 138, 139, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_NFS, no_master, no_master, "NFS", NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, ndpi_build_default_ports(ports_a, 2049, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 2049, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SSDP, no_master, no_master, "SSDP", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_BGP, no_master, no_master, "BGP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 2605, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SNMP, no_master, no_master, "SNMP", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 161, 162, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_XDMCP, no_master, no_master, "XDMCP", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 177, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 177, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SMB, no_master, no_master, "SMB", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 445, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SYSLOG, no_master, no_master, "Syslog", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 514, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 514, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DHCP, no_master, no_master, "DHCP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 67, 68, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_POSTGRES, no_master, no_master, "PostgreSQL", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 5432, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MYSQL, no_master, no_master, "MySQL", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 3306, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, no_master, no_master, "Direct_Download_Link", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_APPLEJUICE, no_master, no_master, "AppleJuice", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_DIRECTCONNECT, no_master, no_master, "DirectConnect", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_SOCRATES, no_master, no_master, "Socrates", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_VMWARE, no_master, no_master, "VMware", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 903, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 902, 903, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FILETOPIA, no_master, no_master, "Filetopia", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_KONTIKI, no_master, no_master, "Kontiki", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_OPENFT, no_master, no_master, "OpenFT", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_FASTTRACK, no_master, no_master, "FastTrack", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_GNUTELLA, no_master, no_master, "Gnutella", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNSAFE, NDPI_PROTOCOL_EDONKEY, no_master, no_master, "eDonkey", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNSAFE, NDPI_PROTOCOL_BITTORRENT, no_master, no_master, "BitTorrent", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 51413, 53646, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 6771, 51413, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SKYPE, no_master, no_master, "Skype", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TEREDO, no_master, no_master, "Teredo", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 3544, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_EPP, no_master, no_master, "EPP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_CONTENT_AVI, no_master, no_master, "AVI", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_CONTENT_FLASH, no_master, no_master, "Flash", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_CONTENT_OGG, no_master, no_master, "OggVorbis", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_CONTENT_MPEG, no_master, no_master, "MPEG", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_CONTENT_QUICKTIME, no_master, no_master, "QuickTime", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_CONTENT_REALMEDIA, no_master, no_master, "RealMedia", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_CONTENT_WINDOWSMEDIA, no_master, no_master, "WindowsMedia", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_CONTENT_MMS, no_master, no_master, "MMS", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_XBOX, no_master, no_master, "Xbox", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_QQ, no_master, no_master, "QQ", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_MOVE, no_master, no_master, "Move", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_RTSP, no_master, no_master, "RTSP", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 554, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 554, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_ICECAST, no_master, no_master, "IceCast", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_PPLIVE, no_master, no_master, "PPLive", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_PPSTREAM, no_master, no_master, "PPStream", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_ZATTOO, no_master, no_master, "Zattoo", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_SHOUTCAST, no_master, no_master, "ShoutCast", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_SOPCAST, no_master, no_master, "Sopcast", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_TVANTS, no_master, no_master, "Tvants", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_TVUPLAYER, no_master, no_master, "TVUplayer", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HTTP_DOWNLOAD, no_master, no_master, "HTTP_Download", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_QQLIVE, no_master, no_master, "QQLive", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_THUNDER, no_master, no_master, "Thunder", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_SOULSEEK, no_master, no_master, "Soulseek", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); custom_master[0] = NDPI_PROTOCOL_SSL, custom_master[1] = NDPI_PROTOCOL_UNKNOWN; ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SSL_NO_CERT, custom_master, no_master, "SSL_No_Cert", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNSAFE, NDPI_PROTOCOL_IRC, no_master, no_master, "IRC", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 194, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 194, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AYIYA, no_master, no_master, "Ayiya", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 5072, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_UNENCRYPTED_JABBER, no_master, no_master, "Unencrypted_Jabber", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_OSCAR, no_master, no_master, "Oscar", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_BATTLEFIELD, no_master, no_master, "BattleField", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_QUAKE, no_master, no_master, "Quake", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_VRRP, no_master, no_master, "VRRP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_STEAM, no_master, no_master, "Steam", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_HALFLIFE2, no_master, no_master, "HalfLife2", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_WORLDOFWARCRAFT, no_master, no_master, "WorldOfWarcraft", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_HOTSPOT_SHIELD, no_master, no_master, "HotspotShield", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_UNSAFE, NDPI_PROTOCOL_TELNET, no_master, no_master, "Telnet", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 23, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); custom_master[0] = NDPI_PROTOCOL_SIP, custom_master[1] = NDPI_PROTOCOL_H323; ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_STUN, no_master, custom_master, "STUN", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 3478, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_IP_IPSEC, no_master, no_master, "IPsec", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 500, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 500, 4500, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_GRE, no_master, no_master, "GRE", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_ICMP, no_master, no_master, "ICMP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_IGMP, no_master, no_master, "IGMP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_EGP, no_master, no_master, "EGP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_SCTP, no_master, no_master, "SCTP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_OSPF, no_master, no_master, "OSPF", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 2604, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_IP_IN_IP, no_master, no_master, "IP_in_IP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RTP, no_master, no_master, "RTP", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RDP, no_master, no_master, "RDP", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 3389, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_VNC, no_master, no_master, "VNC", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 5900, 5901, 5800, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_PCANYWHERE, no_master, no_master, "PcAnywhere", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WHATSAPP_VOICE, no_master, no_master, "WhatsAppVoice", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); custom_master[0] = NDPI_PROTOCOL_SSL_NO_CERT, custom_master[1] = NDPI_PROTOCOL_UNKNOWN; ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_SSL, no_master, custom_master, "SSL", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 443, 3001 /* ntop */, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SSH, no_master, no_master, "SSH", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 22, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_USENET, no_master, no_master, "Usenet", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MGCP, no_master, no_master, "MGCP", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IAX, no_master, no_master, "IAX", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 4569, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 4569, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AFP, no_master, no_master, "AFP", NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, ndpi_build_default_ports(ports_a, 548, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 548, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CHECKMK, no_master, no_master, "CHECKMK", NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, ndpi_build_default_ports(ports_a, 6556, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_STEALTHNET, no_master, no_master, "Stealthnet", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_AIMINI, no_master, no_master, "Aimini", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SIP, no_master, no_master, "SIP", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 5060, 5061, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 5060, 5061, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TRUPHONE, no_master, no_master, "TruPhone", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_IP_ICMPV6, no_master, no_master, "ICMPV6", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DHCPV6, no_master, no_master, "DHCPV6", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_ARMAGETRON, no_master, no_master, "Armagetron", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_CROSSFIRE, no_master, no_master, "Crossfire", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DOFUS, no_master, no_master, "Dofus", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FIESTA, no_master, no_master, "Fiesta", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_FLORENSIA, no_master, no_master, "Florensia", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_GUILDWARS, no_master, no_master, "Guildwars", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC, no_master, no_master, "HTTP_Application_ActiveSync", NDPI_PROTOCOL_CATEGORY_CLOUD, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_KERBEROS, no_master, no_master, "Kerberos", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 88, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 88, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_LDAP, no_master, no_master, "LDAP", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 389, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 389, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_MAPLESTORY, no_master, no_master, "MapleStory", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MSSQL_TDS, no_master, no_master, "MsSQL-TDS", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 1433, 1434, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_PPTP, no_master, no_master, "PPTP", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_WARCRAFT3, no_master, no_master, "Warcraft3", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_WORLD_OF_KUNG_FU, no_master, no_master, "WorldOfKungFu", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DCERPC, no_master, no_master, "DCE_RPC", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 135, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_NETFLOW, no_master, no_master, "NetFlow", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 2055, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SFLOW, no_master, no_master, "sFlow", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 6343, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HTTP_CONNECT, no_master, no_master, "HTTP_Connect", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HTTP_PROXY, no_master, no_master, "HTTP_Proxy", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 8080, 3128, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CITRIX, no_master, no_master, "Citrix", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 1494, 2598, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CITRIX_ONLINE, no_master, no_master, "Citrix_Online", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WEBEX, no_master, no_master, "Webex", NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RADIUS, no_master, no_master, "Radius", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 1812, 1813, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 1812, 1813, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TEAMVIEWER, no_master, no_master, "TeamViewer", NDPI_PROTOCOL_CATEGORY_REMOTE_ACCESS, ndpi_build_default_ports(ports_a, 5938, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 5938, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_LOTUS_NOTES, no_master, no_master, "LotusNotes", NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, ndpi_build_default_ports(ports_a, 1352, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SAP, no_master, no_master, "SAP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 3201, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_GTP, no_master, no_master, "GTP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 2152, 2123, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_UPNP, no_master, no_master, "UPnP", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 1780, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 1900, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TELEGRAM, no_master, no_master, "Telegram", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_QUIC, no_master, no_master, "QUIC", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 443, 80, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DROPBOX, no_master, no_master, "Dropbox", NDPI_PROTOCOL_CATEGORY_CLOUD, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 17500, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_LISP, no_master, no_master, "LISP", NDPI_PROTOCOL_CATEGORY_CLOUD, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 4342, 4341, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_EAQ, no_master, no_master, "EAQ", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 6000, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_KAKAOTALK_VOICE, no_master, no_master, "KakaoTalk_Voice", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_MPEGTS, no_master, no_master, "MPEG_TS", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); /* http://en.wikipedia.org/wiki/Link-local_Multicast_Name_Resolution */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_LLMNR, no_master, no_master, "LLMNR", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 5355, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 5355, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_POTENTIALLY_DANGEROUS, NDPI_PROTOCOL_REMOTE_SCAN, no_master, no_master, "RemoteScan", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 6077, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 6078, 0, 0, 0, 0) /* UDP */); /* Missing dissector: port based only */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_CONTENT_WEBM, no_master, no_master, "WebM", NDPI_PROTOCOL_CATEGORY_MEDIA, /* Courtesy of Shreeram Ramamoorthy Swaminathan */ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_H323, no_master, no_master,"H323", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 1719, 1720, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 1719, 1720, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_OPENVPN, no_master, no_master, "OpenVPN", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 1194, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 1194, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_NOE, no_master, no_master, "NOE", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CISCOVPN, no_master, no_master, "CiscoVPN", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 10000, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 10000, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TEAMSPEAK, no_master, no_master, "TeamSpeak", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SKINNY, no_master, no_master, "CiscoSkinny", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 2000, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RTCP, no_master, no_master, "RTCP", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RSYNC, no_master, no_master, "RSYNC", NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, ndpi_build_default_ports(ports_a, 873, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_ORACLE, no_master, no_master, "Oracle", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 1521, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_CORBA, no_master, no_master, "Corba", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_UBUNTUONE, no_master, no_master, "UbuntuONE", NDPI_PROTOCOL_CATEGORY_CLOUD, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WHOIS_DAS, no_master, no_master, "Whois-DAS", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 43, 4343, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_COLLECTD, no_master, no_master, "Collectd", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 25826, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SOCKS, no_master, no_master, "SOCKS", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 1080, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 1080, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TFTP, no_master, no_master, "TFTP", NDPI_PROTOCOL_CATEGORY_DATA_TRANSFER, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 69, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RTMP, no_master, no_master, "RTMP", NDPI_PROTOCOL_CATEGORY_MEDIA, ndpi_build_default_ports(ports_a, 1935, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_PANDO, no_master, no_master, "Pando_Media_Booster", NDPI_PROTOCOL_CATEGORY_WEB, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MEGACO, no_master, no_master, "Megaco", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 2944 , 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_REDIS, no_master, no_master, "Redis", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 6379, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0 , 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_ZMQ, no_master, no_master, "ZeroMQ", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0 , 0, 0, 0, 0) ); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_VHUA, no_master, no_master, "VHUA", NDPI_PROTOCOL_CATEGORY_VOIP, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 58267, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_STARCRAFT, no_master, no_master, "Starcraft", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 1119, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 1119, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_UBNTAC2, no_master, no_master, "UBNTAC2", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 10001, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_VIBER, no_master, no_master, "Viber", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 7985, 7987, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_COAP, no_master, no_master, "COAP", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 5683, 5684, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MQTT, no_master, no_master, "MQTT", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SOMEIP, no_master, no_master, "SOMEIP", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 30491, 30501, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 30491, 30501, 30490, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RX, no_master, no_master, "RX", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_GIT, no_master, no_master, "Git", NDPI_PROTOCOL_CATEGORY_COLLABORATIVE, ndpi_build_default_ports(ports_a, 9418, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DRDA, no_master, no_master, "DRDA", NDPI_PROTOCOL_CATEGORY_DATABASE, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_HANGOUT, no_master, no_master, "GoogleHangout", NDPI_PROTOCOL_CATEGORY_CHAT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_BJNP, no_master, no_master, "BJNP", NDPI_PROTOCOL_CATEGORY_SYSTEM_OS, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 8612, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SMPP, no_master, no_master, "SMPP", NDPI_PROTOCOL_CATEGORY_DOWNLOAD_FT, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_OOKLA, no_master, no_master, "Ookla", NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_AMQP, no_master, no_master, "AMQP", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_DNSCRYPT, no_master, no_master, "DNScrypt", NDPI_PROTOCOL_CATEGORY_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0), /* TCP */ ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_TINC, no_master, no_master, "TINC", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 655, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 655, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_SAFE, NDPI_PROTOCOL_FIX, no_master, no_master, "FIX", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_NINTENDO, no_master, no_master, "Nintendo", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_CSGO, no_master, no_master, "CSGO", NDPI_PROTOCOL_CATEGORY_GAME, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); /* calling function for host and content matched protocols */ init_string_based_protocols(ndpi_mod); for(i=0; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++) { if((ndpi_mod->proto_defaults[i].protoName == NULL) || ((i != NDPI_PROTOCOL_UNKNOWN) && (ndpi_mod->proto_defaults[i].protoCategory == NDPI_PROTOCOL_CATEGORY_UNSPECIFIED))) { printf("[NDPI] %s(missing protoId=%d/%s) INTERNAL ERROR: not all protocols have been initialized\n", __FUNCTION__, i, ndpi_mod->proto_defaults[i].protoName ? ndpi_mod->proto_defaults[i].protoName : "???"); } } } /* ****************************************************** */ static int ac_match_handler(AC_MATCH_t *m, void *param) { int *matching_protocol_id = (int*)param; /* Return 1 for stopping to the first match. We might consider searching for the more specific match, paying more cpu cycles. */ *matching_protocol_id = m->patterns[0].rep.number; return 0; /* 0 to continue searching, !0 to stop */ } /* ******************************************************************** */ #ifdef NDPI_PROTOCOL_TOR static int fill_prefix_v4(prefix_t *p, struct in_addr *a, int b, int mb) { do { if(b < 0 || b > mb) return(-1); memset(p, 0, sizeof(prefix_t)); memcpy(&p->add.sin, a, (mb+7)/8); p->family = AF_INET; p->bitlen = b; p->ref_count = 0; } while (0); return(0); } /* ******************************************* */ u_int16_t ndpi_network_ptree_match(struct ndpi_detection_module_struct *ndpi_struct, struct in_addr *pin /* network byte order */) { prefix_t prefix; patricia_node_t *node; /* Make sure all in network byte order otherwise compares wont work */ fill_prefix_v4(&prefix, pin, 32, ((patricia_tree_t*)ndpi_struct->protocols_ptree)->maxbits); node = ndpi_patricia_search_best(ndpi_struct->protocols_ptree, &prefix); return(node ? node->value.user_value : NDPI_PROTOCOL_UNKNOWN); } /* ******************************************* */ /* u_int16_t ndpi_host_ptree_match(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t host /\* network byte order *\/) { */ /* struct in_addr pin; */ /* pin.s_addr = host; */ /* return(ndpi_network_ptree_match(ndpi_struct, &pin)); */ /* } */ /* ******************************************* */ #if 0 static u_int8_t tor_ptree_match(struct ndpi_detection_module_struct *ndpi_struct, struct in_addr *pin) { return((ndpi_network_ptree_match(ndpi_struct, pin) == NDPI_PROTOCOL_TOR) ? 1 : 0); } #endif /* ******************************************* */ u_int8_t ndpi_is_tor_flow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->tcp != NULL) { if(packet->iph) { if(flow->guessed_host_protocol_id == NDPI_PROTOCOL_TOR) return(1); } } return(0); } /* ******************************************* */ static patricia_node_t* add_to_ptree(patricia_tree_t *tree, int family, void *addr, int bits) { prefix_t prefix; patricia_node_t *node; fill_prefix_v4(&prefix, (struct in_addr*)addr, bits, tree->maxbits); node = ndpi_patricia_lookup(tree, &prefix); return(node); } /* ******************************************* */ static void ndpi_init_ptree_ipv4(struct ndpi_detection_module_struct *ndpi_str, void *ptree, ndpi_network host_list[]) { int i; for(i=0; host_list[i].network != 0x0; i++) { struct in_addr pin; patricia_node_t *node; pin.s_addr = htonl(host_list[i].network); if((node = add_to_ptree(ptree, AF_INET, &pin, host_list[i].cidr /* bits */)) != NULL) node->value.user_value = host_list[i].value; } } /* ******************************************* */ static int ndpi_add_host_ip_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, char *value, int protocol_id) { patricia_node_t *node; struct in_addr pin; int bits = 32; char *ptr = strrchr(value, '/'); if (ptr) { ptr[0] = '\0'; ptr++; if (atoi(ptr)>=0 && atoi(ptr)<=32) bits = atoi(ptr); } inet_pton(AF_INET, value, &pin); if((node = add_to_ptree(ndpi_struct->protocols_ptree, AF_INET, &pin, bits)) != NULL) node->value.user_value = protocol_id; return 0; } #endif void set_ndpi_malloc(void* (*__ndpi_malloc)(size_t size)) { _ndpi_malloc = __ndpi_malloc; } void set_ndpi_flow_malloc(void* (*__ndpi_flow_malloc)(size_t size)) { _ndpi_flow_malloc = __ndpi_flow_malloc; } void set_ndpi_free(void (*__ndpi_free)(void *ptr)) { _ndpi_free = __ndpi_free; } void set_ndpi_flow_free(void (*__ndpi_flow_free)(void *ptr)) { _ndpi_flow_free = __ndpi_flow_free; } void ndpi_debug_printf(unsigned int proto, struct ndpi_detection_module_struct *ndpi_str, ndpi_log_level_t log_level, const char * format, ...) { #ifdef NDPI_ENABLE_DEBUG_MESSAGES va_list args; #define MAX_STR_LEN 120 char str[MAX_STR_LEN]; va_start(args, format); vsprintf(str, format, args); va_end(args); if (ndpi_str != NULL) { char proto_name[64]; snprintf(proto_name, sizeof(proto_name), "%s", ndpi_get_proto_name(ndpi_str, proto)); printf("%s:%s:%u - Proto: %s, %s\n", ndpi_str->ndpi_debug_print_file, ndpi_str->ndpi_debug_print_function, ndpi_str->ndpi_debug_print_line, proto_name, str); } else { printf("Proto: %u, %s\n", proto, str); } #endif } void set_ndpi_debug_function(struct ndpi_detection_module_struct *ndpi_str, ndpi_debug_function_ptr ndpi_debug_printf) { #ifdef NDPI_ENABLE_DEBUG_MESSAGES ndpi_str->ndpi_debug_printf = ndpi_debug_printf; #endif } /* ******************************************************************** */ struct ndpi_detection_module_struct *ndpi_init_detection_module(void) { struct ndpi_detection_module_struct *ndpi_str = ndpi_malloc(sizeof(struct ndpi_detection_module_struct)); int i; if(ndpi_str == NULL) { #ifdef NDPI_ENABLE_DEBUG_MESSAGES NDPI_LOG(0, ndpi_str, NDPI_LOG_DEBUG, "ndpi_init_detection_module initial malloc failed for ndpi_str\n"); #endif /* NDPI_ENABLE_DEBUG_MESSAGES */ return NULL; } memset(ndpi_str, 0, sizeof(struct ndpi_detection_module_struct)); #ifdef NDPI_ENABLE_DEBUG_MESSAGES set_ndpi_debug_function(ndpi_str, (ndpi_debug_function_ptr)ndpi_debug_printf); #endif /* NDPI_ENABLE_DEBUG_MESSAGES */ if((ndpi_str->protocols_ptree = ndpi_New_Patricia(32 /* IPv4 */)) != NULL) ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, host_protocol_list); NDPI_BITMASK_RESET(ndpi_str->detection_bitmask); #ifdef NDPI_ENABLE_DEBUG_MESSAGES ndpi_str->user_data = NULL; #endif ndpi_str->ticks_per_second = 1000; /* ndpi_str->ticks_per_second */ ndpi_str->tcp_max_retransmission_window_size = NDPI_DEFAULT_MAX_TCP_RETRANSMISSION_WINDOW_SIZE; ndpi_str->directconnect_connection_ip_tick_timeout = NDPI_DIRECTCONNECT_CONNECTION_IP_TICK_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->rtsp_connection_timeout = NDPI_RTSP_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->tvants_connection_timeout = NDPI_TVANTS_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->irc_timeout = NDPI_IRC_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->gnutella_timeout = NDPI_GNUTELLA_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->battlefield_timeout = NDPI_BATTLEFIELD_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->thunder_timeout = NDPI_THUNDER_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->yahoo_detect_http_connections = NDPI_YAHOO_DETECT_HTTP_CONNECTIONS; ndpi_str->yahoo_lan_video_timeout = NDPI_YAHOO_LAN_VIDEO_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->zattoo_connection_timeout = NDPI_ZATTOO_CONNECTION_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->jabber_stun_timeout = NDPI_JABBER_STUN_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->jabber_file_transfer_timeout = NDPI_JABBER_FT_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->soulseek_connection_ip_tick_timeout = NDPI_SOULSEEK_CONNECTION_IP_TICK_TIMEOUT * ndpi_str->ticks_per_second; ndpi_str->ndpi_num_supported_protocols = NDPI_MAX_SUPPORTED_PROTOCOLS; ndpi_str->ndpi_num_custom_protocols = 0; ndpi_str->host_automa.ac_automa = ac_automata_init(ac_match_handler); ndpi_str->content_automa.ac_automa = ac_automata_init(ac_match_handler); ndpi_str->bigrams_automa.ac_automa = ac_automata_init(ac_match_handler); ndpi_str->impossible_bigrams_automa.ac_automa = ac_automata_init(ac_match_handler); ndpi_init_protocol_defaults(ndpi_str); for(i=0; icustom_category_labels[i], CUSTOM_CATEGORY_LABEL_LEN, "User custom category %u", i+1); return ndpi_str; } /* *********************************************** */ /* Wrappers */ void* ndpi_init_automa(void) { return(ac_automata_init(ac_match_handler)); } int ndpi_add_string_value_to_automa(void *_automa, char *str, unsigned long num) { AC_PATTERN_t ac_pattern; AC_AUTOMATA_t *automa = (AC_AUTOMATA_t*)_automa; if(automa == NULL) return(-1); ac_pattern.astring = str; ac_pattern.rep.number = num; ac_pattern.length = strlen(ac_pattern.astring); return(ac_automata_add(automa, &ac_pattern) == ACERR_SUCCESS ? 0 : -1); } int ndpi_add_string_to_automa(void *_automa, char *str) { return(ndpi_add_string_value_to_automa(_automa, str, 1)); } void ndpi_free_automa(void *_automa) { ac_automata_release((AC_AUTOMATA_t*)_automa); } void ndpi_finalize_automa(void *_automa) { ac_automata_finalize((AC_AUTOMATA_t*)_automa); } /* ****************************************************** */ int ndpi_match_string(void *_automa, char *string_to_match) { int matching_protocol_id = NDPI_PROTOCOL_UNKNOWN; AC_TEXT_t ac_input_text; AC_AUTOMATA_t *automa = (AC_AUTOMATA_t*)_automa; if((automa == NULL) || (string_to_match == NULL) || (string_to_match[0] == '\0')) return(-2); ac_input_text.astring = string_to_match, ac_input_text.length = strlen(string_to_match); ac_automata_search(automa, &ac_input_text, (void*)&matching_protocol_id); ac_automata_reset(automa); return(matching_protocol_id > 0 ? 0 : -1); } /* ****************************************************** */ int ndpi_match_string_id(void *_automa, char *string_to_match, unsigned long *id) { AC_TEXT_t ac_input_text; AC_AUTOMATA_t *automa = (AC_AUTOMATA_t*)_automa; *id = -1; if((automa == NULL) || (string_to_match == NULL) || (string_to_match[0] == '\0')) return(-2); ac_input_text.astring = string_to_match, ac_input_text.length = strlen(string_to_match); ac_automata_search(automa, &ac_input_text, (void*)id); ac_automata_reset(automa); return(*id != -1 ? 0 : -1); } /* *********************************************** */ static void free_ptree_data(void *data) { ; } /* ****************************************************** */ void ndpi_exit_detection_module(struct ndpi_detection_module_struct *ndpi_struct) { if(ndpi_struct != NULL) { int i; for(i=0; i<(int)ndpi_struct->ndpi_num_supported_protocols; i++) { if(ndpi_struct->proto_defaults[i].protoName) ndpi_free(ndpi_struct->proto_defaults[i].protoName); } #ifdef NDPI_PROTOCOL_TINC if(ndpi_struct->tinc_cache) cache_free(ndpi_struct->tinc_cache); #endif if(ndpi_struct->protocols_ptree) ndpi_Destroy_Patricia((patricia_tree_t*)ndpi_struct->protocols_ptree, free_ptree_data); ndpi_tdestroy(ndpi_struct->udpRoot, ndpi_free); ndpi_tdestroy(ndpi_struct->tcpRoot, ndpi_free); if(ndpi_struct->host_automa.ac_automa != NULL) ac_automata_release((AC_AUTOMATA_t*)ndpi_struct->host_automa.ac_automa); if(ndpi_struct->content_automa.ac_automa != NULL) ac_automata_release((AC_AUTOMATA_t*)ndpi_struct->content_automa.ac_automa); if(ndpi_struct->bigrams_automa.ac_automa != NULL) ac_automata_release((AC_AUTOMATA_t*)ndpi_struct->bigrams_automa.ac_automa); if(ndpi_struct->impossible_bigrams_automa.ac_automa != NULL) ac_automata_release((AC_AUTOMATA_t*)ndpi_struct->impossible_bigrams_automa.ac_automa); ndpi_free(ndpi_struct); } } /* ****************************************************** */ int ndpi_get_protocol_id_master_proto(struct ndpi_detection_module_struct *ndpi_struct, u_int16_t protocol_id, u_int16_t** tcp_master_proto, u_int16_t** udp_master_proto) { if(protocol_id >= (NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS)) { *tcp_master_proto = *udp_master_proto = NDPI_PROTOCOL_UNKNOWN; return(-1); } *tcp_master_proto = ndpi_struct->proto_defaults[protocol_id].master_tcp_protoId, *udp_master_proto = ndpi_struct->proto_defaults[protocol_id].master_udp_protoId; return(0); } /* ****************************************************** */ static ndpi_default_ports_tree_node_t* ndpi_get_guessed_protocol_id(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t proto, u_int16_t sport, u_int16_t dport) { const void *ret; ndpi_default_ports_tree_node_t node; if(sport && dport) { int low = ndpi_min(sport, dport); int high = ndpi_max(sport, dport); node.default_port = low; /* Check server port first */ ret = ndpi_tfind(&node, (proto == IPPROTO_TCP) ? (void*)&ndpi_struct->tcpRoot : (void*)&ndpi_struct->udpRoot, ndpi_default_ports_tree_node_t_cmp); if(ret == NULL) { node.default_port = high; ret = ndpi_tfind(&node, (proto == IPPROTO_TCP) ? (void*)&ndpi_struct->tcpRoot : (void*)&ndpi_struct->udpRoot, ndpi_default_ports_tree_node_t_cmp); } if(ret) return(*(ndpi_default_ports_tree_node_t**)ret); } return(NULL); } /* ****************************************************** */ u_int16_t ndpi_guess_protocol_id(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t proto, u_int16_t sport, u_int16_t dport, u_int8_t *user_defined_proto) { *user_defined_proto = 0; /* Default */ if(sport && dport) { ndpi_default_ports_tree_node_t *found = ndpi_get_guessed_protocol_id(ndpi_struct, proto, sport, dport); if(found != NULL) { *user_defined_proto = found->customUserProto; return(found->proto->protoId); } } else { /* No TCP/UDP */ switch(proto) { case NDPI_IPSEC_PROTOCOL_ESP: case NDPI_IPSEC_PROTOCOL_AH: return(NDPI_PROTOCOL_IP_IPSEC); break; case NDPI_GRE_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_GRE); break; case NDPI_ICMP_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_ICMP); break; case NDPI_IGMP_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_IGMP); break; case NDPI_EGP_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_EGP); break; case NDPI_SCTP_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_SCTP); break; case NDPI_OSPF_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_OSPF); break; case NDPI_IPIP_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_IP_IN_IP); break; case NDPI_ICMPV6_PROTOCOL_TYPE: return(NDPI_PROTOCOL_IP_ICMPV6); break; case 112: return(NDPI_PROTOCOL_IP_VRRP); break; } } return(NDPI_PROTOCOL_UNKNOWN); } /* ******************************************************************** */ u_int ndpi_get_num_supported_protocols(struct ndpi_detection_module_struct *ndpi_mod) { return(ndpi_mod->ndpi_num_supported_protocols); } /* ******************************************************************** */ #ifdef WIN32 char * strsep(char **sp, char *sep) { char *p, *s; if (sp == NULL || *sp == NULL || **sp == '\0') return(NULL); s = *sp; p = s + strcspn(s, sep); if (*p != '\0') *p++ = '\0'; *sp = p; return(s); } #endif /* ******************************************************************** */ int ndpi_handle_rule(struct ndpi_detection_module_struct *ndpi_mod, char* rule, u_int8_t do_add) { char *at, *proto, *elem; ndpi_proto_defaults_t *def; int subprotocol_id, i; at = strrchr(rule, '@'); if(at == NULL) { printf("Invalid rule '%s'\n", rule); return(-1); } else at[0] = 0, proto = &at[1]; for(i=0; proto[i] != '\0'; i++) { switch(proto[i]) { case '/': case '&': case '^': case ':': case ';': case '\'': case '"': case ' ': proto[i] = '_'; break; } } for(i=0, def = NULL; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++) { if(strcasecmp(ndpi_mod->proto_defaults[i].protoName, proto) == 0) { def = &ndpi_mod->proto_defaults[i]; subprotocol_id = i; break; } } if(def == NULL) { if(!do_add) { /* We need to remove a rule */ printf("Unable to find protocol '%s': skipping rule '%s'\n", proto, rule); return(-3); } else { ndpi_port_range ports_a[MAX_DEFAULT_PORTS], ports_b[MAX_DEFAULT_PORTS]; u_int16_t no_master[2] = { NDPI_PROTOCOL_NO_MASTER_PROTO, NDPI_PROTOCOL_NO_MASTER_PROTO }; if(ndpi_mod->ndpi_num_custom_protocols >= (NDPI_MAX_NUM_CUSTOM_PROTOCOLS-1)) { printf("Too many protocols defined (%u): skipping protocol %s\n", ndpi_mod->ndpi_num_custom_protocols, proto); return(-2); } ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, ndpi_mod->ndpi_num_supported_protocols, no_master, no_master, ndpi_strdup(proto), NDPI_PROTOCOL_CATEGORY_UNSPECIFIED, /* TODO add protocol category support in rules */ ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); def = &ndpi_mod->proto_defaults[ndpi_mod->ndpi_num_supported_protocols]; subprotocol_id = ndpi_mod->ndpi_num_supported_protocols; ndpi_mod->ndpi_num_supported_protocols++, ndpi_mod->ndpi_num_custom_protocols++; } } while((elem = strsep(&rule, ",")) != NULL) { char *attr = elem, *value = NULL; ndpi_port_range range; int is_tcp = 0, is_udp = 0, is_ip = 0; if(strncmp(attr, "tcp:", 4) == 0) is_tcp = 1, value = &attr[4]; else if(strncmp(attr, "udp:", 4) == 0) is_udp = 1, value = &attr[4]; else if(strncmp(attr, "ip:", 3) == 0) is_ip = 1, value = &attr[3]; else if(strncmp(attr, "host:", 5) == 0) { /* host:"",host:"",.....@ */ value = &attr[5]; if(value[0] == '"') value++; /* remove leading " */ if(value[strlen(value)-1] == '"') value[strlen(value)-1] = '\0'; /* remove trailing " */ } if(is_tcp || is_udp) { if(sscanf(value, "%u-%u", (u_int32_t *)&range.port_low, (u_int32_t *)&range.port_high) != 2) range.port_low = range.port_high = atoi(&elem[4]); if(do_add) addDefaultPort(&range, def, 1 /* Custom user proto */, is_tcp ? &ndpi_mod->tcpRoot : &ndpi_mod->udpRoot); else removeDefaultPort(&range, def, is_tcp ? &ndpi_mod->tcpRoot : &ndpi_mod->udpRoot); } else if(is_ip) { #ifdef NDPI_PROTOCOL_TOR ndpi_add_host_ip_subprotocol(ndpi_mod, value, subprotocol_id); #endif } else { if(do_add) ndpi_add_host_url_subprotocol(ndpi_mod, value, subprotocol_id, NDPI_PROTOCOL_ACCEPTABLE); else ndpi_remove_host_url_subprotocol(ndpi_mod, value, subprotocol_id); } } return(0); } /* ******************************************************************** */ /* Format: :,:,.....@ Example: tcp:80,tcp:3128@HTTP udp:139@NETBIOS */ int ndpi_load_protocols_file(struct ndpi_detection_module_struct *ndpi_mod, char* path) { FILE *fd = fopen(path, "r"); int i; if(fd == NULL) { printf("Unable to open file %s [%s]", path, strerror(errno)); return(-1); } while(fd) { char buffer[512], *line; if(!(line = fgets(buffer, sizeof(buffer), fd))) break; if(((i = strlen(line)) <= 1) || (line[0] == '#')) continue; else line[i-1] = '\0'; ndpi_handle_rule(ndpi_mod, line, 1); } fclose(fd); return(0); } /* ******************************************************************** */ /* ntop */ void ndpi_set_bitmask_protocol_detection(char * label, struct ndpi_detection_module_struct *ndpi_struct, const NDPI_PROTOCOL_BITMASK * detection_bitmask, const u_int32_t idx, u_int16_t ndpi_protocol_id, void (*func) (struct ndpi_detection_module_struct *, struct ndpi_flow_struct *flow), const NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_bitmask, u_int8_t b_save_bitmask_unknow, u_int8_t b_add_detection_bitmask) { /* Compare specify protocol bitmask with main detection bitmask */ if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(*detection_bitmask, ndpi_protocol_id) != 0) { #ifdef DEBUG NDPI_LOG(0, ndpi_struct, NDPI_LOG_DEBUG,"[NDPI] ndpi_set_bitmask_protocol_detection: %s : [callback_buffer] idx= %u, [proto_defaults] protocol_id=%u\n", label, idx, ndpi_protocol_id); #endif if(ndpi_struct->proto_defaults[ndpi_protocol_id].protoIdx != 0) printf("[NDPI] Internal error: protocol %s/%u has been already registered\n", label, ndpi_protocol_id); else { #ifdef DEBUG printf("[NDPI] Adding %s with protocol id %d\n", label, ndpi_protocol_id); #endif } /* Set function and index protocol within proto_default structure for port protocol detection and callback_buffer function for DPI protocol detection */ ndpi_struct->proto_defaults[ndpi_protocol_id].protoIdx = idx; ndpi_struct->proto_defaults[ndpi_protocol_id].func = ndpi_struct->callback_buffer[idx].func = func; /* Set ndpi_selection_bitmask for protocol */ ndpi_struct->callback_buffer[idx].ndpi_selection_bitmask = ndpi_selection_bitmask; /* Reset protocol detection bitmask via NDPI_PROTOCOL_UNKNOWN and than add specify protocol bitmast to callback buffer. */ if(b_save_bitmask_unknow) NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[idx].detection_bitmask, NDPI_PROTOCOL_UNKNOWN); if(b_add_detection_bitmask) NDPI_ADD_PROTOCOL_TO_BITMASK(ndpi_struct->callback_buffer[idx].detection_bitmask, ndpi_protocol_id); NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[idx].excluded_protocol_bitmask, ndpi_protocol_id); } } /* ******************************************************************** */ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *ndpi_struct, const NDPI_PROTOCOL_BITMASK * dbm) { NDPI_PROTOCOL_BITMASK detection_bitmask_local; NDPI_PROTOCOL_BITMASK *detection_bitmask = &detection_bitmask_local; u_int32_t a = 0; NDPI_BITMASK_SET(detection_bitmask_local, *dbm); NDPI_BITMASK_SET(ndpi_struct->detection_bitmask, *dbm); /* set this here to zero to be interrupt safe */ ndpi_struct->callback_buffer_size = 0; /* HTTP */ init_http_dissector(ndpi_struct, &a, detection_bitmask); /* STARCRAFT */ init_starcraft_dissector(ndpi_struct, &a, detection_bitmask); /* SSL */ init_ssl_dissector(ndpi_struct, &a, detection_bitmask); /* STUN */ init_stun_dissector(ndpi_struct, &a, detection_bitmask); /* RTP */ init_rtp_dissector(ndpi_struct, &a, detection_bitmask); /* RTSP */ init_rtsp_dissector(ndpi_struct, &a, detection_bitmask); /* RDP */ init_rdp_dissector(ndpi_struct, &a, detection_bitmask); /* SIP */ init_sip_dissector(ndpi_struct, &a, detection_bitmask); /* HEP */ init_hep_dissector(ndpi_struct, &a, detection_bitmask); /* Teredo */ init_teredo_dissector(ndpi_struct, &a, detection_bitmask); /* EDONKEY */ init_edonkey_dissector(ndpi_struct, &a, detection_bitmask); /* FASTTRACK */ init_fasttrack_dissector(ndpi_struct, &a, detection_bitmask); /* GNUTELLA */ init_gnutella_dissector(ndpi_struct, &a, detection_bitmask); /* DIRECTCONNECT */ init_directconnect_dissector(ndpi_struct, &a, detection_bitmask); /* MSN */ init_msn_dissector(ndpi_struct, &a, detection_bitmask); /* YAHOO */ init_yahoo_dissector(ndpi_struct, &a, detection_bitmask); /* OSCAR */ init_oscar_dissector(ndpi_struct, &a, detection_bitmask); /* APPLEJUICE */ init_applejuice_dissector(ndpi_struct, &a, detection_bitmask); /* SOULSEEK */ init_soulseek_dissector(ndpi_struct, &a, detection_bitmask); /* SOCKS */ init_socks_dissector(ndpi_struct, &a, detection_bitmask); /* IRC */ init_irc_dissector(ndpi_struct, &a, detection_bitmask); /* JABBER */ init_jabber_dissector(ndpi_struct, &a, detection_bitmask); /* MAIL_POP */ init_mail_pop_dissector(ndpi_struct, &a, detection_bitmask); /* MAIL_IMAP */ init_mail_imap_dissector(ndpi_struct, &a, detection_bitmask); /* MAIL_SMTP */ init_mail_smtp_dissector(ndpi_struct, &a, detection_bitmask); /* USENET */ init_usenet_dissector(ndpi_struct, &a, detection_bitmask); /* DNS */ init_dns_dissector(ndpi_struct, &a, detection_bitmask); /* FILETOPIA */ init_filetopia_dissector(ndpi_struct, &a, detection_bitmask); /* VMWARE */ init_vmware_dissector(ndpi_struct, &a, detection_bitmask); /* MMS */ init_mms_dissector(ndpi_struct, &a, detection_bitmask); /* NON_TCP_UDP */ init_non_tcp_udp_dissector(ndpi_struct, &a, detection_bitmask); /* TVANTS */ init_tvants_dissector(ndpi_struct, &a, detection_bitmask); /* SOPCAST */ init_sopcast_dissector(ndpi_struct, &a, detection_bitmask); /* TVUPLAYER */ init_tvuplayer_dissector(ndpi_struct, &a, detection_bitmask); /* PPSTREAM */ init_ppstream_dissector(ndpi_struct, &a, detection_bitmask); /* PPLIVE */ init_pplive_dissector(ndpi_struct, &a, detection_bitmask); /* IAX */ init_iax_dissector(ndpi_struct, &a, detection_bitmask); /* MGPC */ init_mgpc_dissector(ndpi_struct, &a, detection_bitmask); /* ZATTOO */ init_zattoo_dissector(ndpi_struct, &a, detection_bitmask); /* QQ */ init_qq_dissector(ndpi_struct, &a, detection_bitmask); /* SSH */ init_ssh_dissector(ndpi_struct, &a, detection_bitmask); /* AYIYA */ init_ayiya_dissector(ndpi_struct, &a, detection_bitmask); /* THUNDER */ init_thunder_dissector(ndpi_struct, &a, detection_bitmask); /* VNC */ init_vnc_dissector(ndpi_struct, &a, detection_bitmask); /* TEAMVIEWER */ init_teamviewer_dissector(ndpi_struct, &a, detection_bitmask); /* DHCP */ init_dhcp_dissector(ndpi_struct, &a, detection_bitmask); /* SOCRATES */ init_socrates_dissector(ndpi_struct, &a, detection_bitmask); /* STEAM */ init_steam_dissector(ndpi_struct, &a, detection_bitmask); /* HALFLIFE2 */ init_halflife2_dissector(ndpi_struct, &a, detection_bitmask); /* XBOX */ init_xbox_dissector(ndpi_struct, &a, detection_bitmask); /* HTTP_APPLICATION_ACTIVESYNC */ init_http_activesync_dissector(ndpi_struct, &a, detection_bitmask); /* SMB */ init_smb_dissector(ndpi_struct, &a, detection_bitmask); /* TELNET */ init_telnet_dissector(ndpi_struct, &a, detection_bitmask); /* NTP */ init_ntp_dissector(ndpi_struct, &a, detection_bitmask); /* NFS */ init_nfs_dissector(ndpi_struct, &a, detection_bitmask); /* SSDP */ init_ssdp_dissector(ndpi_struct, &a, detection_bitmask); /* WORLD_OF_WARCRAFT */ init_world_of_warcraft_dissector(ndpi_struct, &a, detection_bitmask); /* POSTGRES */ init_postgres_dissector(ndpi_struct, &a, detection_bitmask); /* MYSQL */ init_mysql_dissector(ndpi_struct, &a, detection_bitmask); /* BGP */ init_bgp_dissector(ndpi_struct, &a, detection_bitmask); /* QUAKE */ init_quake_dissector(ndpi_struct, &a, detection_bitmask); /* BATTLEFIELD */ init_battlefield_dissector(ndpi_struct, &a, detection_bitmask); /* PCANYWHERE */ init_pcanywhere_dissector(ndpi_struct, &a, detection_bitmask); /* SNMP */ init_snmp_dissector(ndpi_struct, &a, detection_bitmask); /* KONTIKI */ init_kontiki_dissector(ndpi_struct, &a, detection_bitmask); /* ICECAST */ init_icecast_dissector(ndpi_struct, &a, detection_bitmask); /* SHOUTCAST */ init_shoutcast_dissector(ndpi_struct, &a, detection_bitmask); /* KERBEROS */ init_kerberos_dissector(ndpi_struct, &a, detection_bitmask); /* OPENFT */ init_openft_dissector(ndpi_struct, &a, detection_bitmask); /* SYSLOG */ init_syslog_dissector(ndpi_struct, &a, detection_bitmask); /* DIRECT_DOWNLOAD_LINK */ init_directdownloadlink_dissector(ndpi_struct, &a, detection_bitmask); /* NETBIOS */ init_netbios_dissector(ndpi_struct, &a, detection_bitmask); /* MDNS */ init_mdns_dissector(ndpi_struct, &a, detection_bitmask); /* IPP */ init_ipp_dissector(ndpi_struct, &a, detection_bitmask); /* LDAP */ init_ldap_dissector(ndpi_struct, &a, detection_bitmask); /* WARCRAFT3 */ init_warcraft3_dissector(ndpi_struct, &a, detection_bitmask); /* XDMCP */ init_xdmcp_dissector(ndpi_struct, &a, detection_bitmask); /* TFTP */ init_tftp_dissector(ndpi_struct, &a, detection_bitmask); /* MSSQL_TDS */ init_mssql_tds_dissector(ndpi_struct, &a, detection_bitmask); /* PPTP */ init_pptp_dissector(ndpi_struct, &a, detection_bitmask); /* STEALTHNET */ init_stealthnet_dissector(ndpi_struct, &a, detection_bitmask); /* DHCPV6 */ init_dhcpv6_dissector(ndpi_struct, &a, detection_bitmask); /* AFP */ init_afp_dissector(ndpi_struct, &a, detection_bitmask); /* check_mk */ init_checkmk_dissector(ndpi_struct, &a, detection_bitmask); /* AIMINI */ init_aimini_dissector(ndpi_struct, &a, detection_bitmask); /* FLORENSIA */ init_florensia_dissector(ndpi_struct, &a, detection_bitmask); /* MAPLESTORY */ init_maplestory_dissector(ndpi_struct, &a, detection_bitmask); /* DOFUS */ init_dofus_dissector(ndpi_struct, &a, detection_bitmask); /* WORLD_OF_KUNG_FU */ init_world_of_kung_fu_dissector(ndpi_struct, &a, detection_bitmask); /* FIESTA */ init_fiesta_dissector(ndpi_struct, &a, detection_bitmask); /* CROSSIFIRE */ init_crossfire_dissector(ndpi_struct, &a, detection_bitmask); /* GUILDWARS */ init_guildwars_dissector(ndpi_struct, &a, detection_bitmask); /* ARMAGETRON */ init_armagetron_dissector(ndpi_struct, &a, detection_bitmask); /* DROPBOX */ init_dropbox_dissector(ndpi_struct, &a, detection_bitmask); /* SPOTIFY */ init_spotify_dissector(ndpi_struct, &a, detection_bitmask); /* RADIUS */ init_radius_dissector(ndpi_struct, &a, detection_bitmask); /* CITRIX */ init_citrix_dissector(ndpi_struct, &a, detection_bitmask); /* LOTUS_NOTES */ init_lotus_notes_dissector(ndpi_struct, &a, detection_bitmask); /* GTP */ init_gtp_dissector(ndpi_struct, &a, detection_bitmask); /* DCERPC */ init_dcerpc_dissector(ndpi_struct, &a, detection_bitmask); /* NETFLOW */ init_netflow_dissector(ndpi_struct, &a, detection_bitmask); /* SFLOW */ init_sflow_dissector(ndpi_struct, &a, detection_bitmask); /* H323 */ init_h323_dissector(ndpi_struct, &a, detection_bitmask); /* OPENVPN */ init_openvpn_dissector(ndpi_struct, &a, detection_bitmask); /* NOE */ init_noe_dissector(ndpi_struct, &a, detection_bitmask); /* CISCOVPN */ init_ciscovpn_dissector(ndpi_struct, &a, detection_bitmask); /* TEAMSPEAK */ init_teamspeak_dissector(ndpi_struct, &a, detection_bitmask); /* VIBER */ init_viber_dissector(ndpi_struct, &a, detection_bitmask); /* TOR */ init_tor_dissector(ndpi_struct, &a, detection_bitmask); /* SKINNY */ init_skinny_dissector(ndpi_struct, &a, detection_bitmask); /* RTCP */ init_rtcp_dissector(ndpi_struct, &a, detection_bitmask); /* RSYNC */ init_rsync_dissector(ndpi_struct, &a, detection_bitmask); /* WHOIS_DAS */ init_whois_das_dissector(ndpi_struct, &a, detection_bitmask); /* ORACLE */ init_oracle_dissector(ndpi_struct, &a, detection_bitmask); /* CORBA */ init_corba_dissector(ndpi_struct, &a, detection_bitmask); /* RTMP */ init_rtmp_dissector(ndpi_struct, &a, detection_bitmask); /* FTP_CONTROL */ init_ftp_control_dissector(ndpi_struct, &a, detection_bitmask); /* FTP_DATA */ init_ftp_data_dissector(ndpi_struct, &a, detection_bitmask); /* PANDO */ init_pando_dissector(ndpi_struct, &a, detection_bitmask); /* MEGACO */ init_megaco_dissector(ndpi_struct, &a, detection_bitmask); /* REDIS */ init_redis_dissector(ndpi_struct, &a, detection_bitmask); /* VHUA */ init_vhua_dissector(ndpi_struct, &a, detection_bitmask); /* ZMQ */ init_zmq_dissector(ndpi_struct, &a, detection_bitmask); /* TELEGRAM */ init_telegram_dissector(ndpi_struct, &a, detection_bitmask); /* QUIC */ init_quic_dissector(ndpi_struct, &a, detection_bitmask); /* EAQ */ init_eaq_dissector(ndpi_struct, &a, detection_bitmask); /* KAKAOTALK_VOICE */ init_kakaotalk_voice_dissector(ndpi_struct, &a, detection_bitmask); /* MPEGTS */ init_mpegts_dissector(ndpi_struct, &a, detection_bitmask); /* UBNTAC2 */ init_ubntac2_dissector(ndpi_struct, &a, detection_bitmask); /* COAP */ init_coap_dissector(ndpi_struct, &a, detection_bitmask); /* MQTT */ init_mqtt_dissector(ndpi_struct, &a, detection_bitmask); /* SOME/IP */ init_someip_dissector(ndpi_struct, &a, detection_bitmask); /* RX */ init_rx_dissector(ndpi_struct, &a, detection_bitmask); /* GIT */ init_git_dissector(ndpi_struct, &a, detection_bitmask); /* HANGOUT */ init_hangout_dissector(ndpi_struct, &a, detection_bitmask); /* DRDA */ init_drda_dissector(ndpi_struct, &a, detection_bitmask); /* BJNP */ init_bjnp_dissector(ndpi_struct, &a, detection_bitmask); /* SMPP */ init_smpp_dissector(ndpi_struct, &a, detection_bitmask); /* TINC */ init_tinc_dissector(ndpi_struct, &a, detection_bitmask); /* FIX */ init_fix_dissector(ndpi_struct, &a, detection_bitmask); /* NINTENDO */ init_nintendo_dissector(ndpi_struct, &a, detection_bitmask); /*** Put false-positive sensitive protocols at the end ***/ /* SKYPE */ init_skype_dissector(ndpi_struct, &a, detection_bitmask); /* BITTORRENT */ init_bittorrent_dissector(ndpi_struct, &a, detection_bitmask); /* AMQP */ init_amqp_dissector(ndpi_struct, &a, detection_bitmask); /* CSGO */ init_csgo_dissector(ndpi_struct, &a, detection_bitmask); /* LISP */ init_lisp_dissector(ndpi_struct, &a, detection_bitmask); /* ----------------------------------------------------------------- */ ndpi_struct->callback_buffer_size = a; NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "callback_buffer_size is %u\n", ndpi_struct->callback_buffer_size); /* now build the specific buffer for tcp, udp and non_tcp_udp */ ndpi_struct->callback_buffer_size_tcp_payload = 0; ndpi_struct->callback_buffer_size_tcp_no_payload = 0; for(a = 0; a < ndpi_struct->callback_buffer_size; a++) { if((ndpi_struct->callback_buffer[a].ndpi_selection_bitmask & (NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC)) != 0) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "callback_buffer_tcp_payload, adding buffer %u as entry %u\n", a, ndpi_struct->callback_buffer_size_tcp_payload); memcpy(&ndpi_struct->callback_buffer_tcp_payload[ndpi_struct->callback_buffer_size_tcp_payload], &ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct)); ndpi_struct->callback_buffer_size_tcp_payload++; if((ndpi_struct-> callback_buffer[a].ndpi_selection_bitmask & NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) == 0) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "\tcallback_buffer_tcp_no_payload, additional adding buffer %u to no_payload process\n", a); memcpy(&ndpi_struct->callback_buffer_tcp_no_payload [ndpi_struct->callback_buffer_size_tcp_no_payload], &ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct)); ndpi_struct->callback_buffer_size_tcp_no_payload++; } } } ndpi_struct->callback_buffer_size_udp = 0; for(a = 0; a < ndpi_struct->callback_buffer_size; a++) { if((ndpi_struct->callback_buffer[a].ndpi_selection_bitmask & (NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC)) != 0) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "callback_buffer_size_udp: adding buffer : %u as entry %u\n", a, ndpi_struct->callback_buffer_size_udp); memcpy(&ndpi_struct->callback_buffer_udp[ndpi_struct->callback_buffer_size_udp], &ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct)); ndpi_struct->callback_buffer_size_udp++; } } ndpi_struct->callback_buffer_size_non_tcp_udp = 0; for(a = 0; a < ndpi_struct->callback_buffer_size; a++) { if((ndpi_struct->callback_buffer[a].ndpi_selection_bitmask & (NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP)) == 0 || (ndpi_struct-> callback_buffer[a].ndpi_selection_bitmask & NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC) != 0) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "callback_buffer_non_tcp_udp: adding buffer : %u as entry %u\n", a, ndpi_struct->callback_buffer_size_non_tcp_udp); memcpy(&ndpi_struct->callback_buffer_non_tcp_udp[ndpi_struct->callback_buffer_size_non_tcp_udp], &ndpi_struct->callback_buffer[a], sizeof(struct ndpi_call_function_struct)); ndpi_struct->callback_buffer_size_non_tcp_udp++; } } } #ifdef NDPI_DETECTION_SUPPORT_IPV6 /* handle extension headers in IPv6 packets * arguments: * l4ptr: pointer to the byte following the initial IPv6 header * l4len: the length of the IPv6 packet excluding the IPv6 header * nxt_hdr: next header value from the IPv6 header * result: * l4ptr: pointer to the start of the actual packet payload * l4len: length of the actual payload * nxt_hdr: protocol of the actual payload * returns 0 upon success and 1 upon failure */ static int ndpi_handle_ipv6_extension_headers(struct ndpi_detection_module_struct *ndpi_struct, const u_int8_t ** l4ptr, u_int16_t * l4len, u_int8_t * nxt_hdr) { while ((*nxt_hdr == 0 || *nxt_hdr == 43 || *nxt_hdr == 44 || *nxt_hdr == 60 || *nxt_hdr == 135 || *nxt_hdr == 59)) { u_int16_t ehdr_len; // no next header if(*nxt_hdr == 59) { return 1; } // fragment extension header has fixed size of 8 bytes and the first byte is the next header type if(*nxt_hdr == 44) { if(*l4len < 8) { return 1; } *nxt_hdr = (*l4ptr)[0]; *l4len -= 8; (*l4ptr) += 8; continue; } // the other extension headers have one byte for the next header type // and one byte for the extension header length in 8 byte steps minus the first 8 bytes ehdr_len = (*l4ptr)[1]; ehdr_len *= 8; ehdr_len += 8; if(*l4len < ehdr_len) { return 1; } *nxt_hdr = (*l4ptr)[0]; *l4len -= ehdr_len; (*l4ptr) += ehdr_len; } return 0; } #endif /* NDPI_DETECTION_SUPPORT_IPV6 */ static u_int8_t ndpi_iph_is_valid_and_not_fragmented(const struct ndpi_iphdr *iph, const u_int16_t ipsize) { //#ifdef REQUIRE_FULL_PACKETS if(ipsize < iph->ihl * 4 || ipsize < ntohs(iph->tot_len) || ntohs(iph->tot_len) < iph->ihl * 4 || (iph->frag_off & htons(0x1FFF)) != 0) { return 0; } //#endif return 1; } static u_int8_t ndpi_detection_get_l4_internal(struct ndpi_detection_module_struct *ndpi_struct, const u_int8_t * l3, u_int16_t l3_len, const u_int8_t ** l4_return, u_int16_t * l4_len_return, u_int8_t * l4_protocol_return, u_int32_t flags) { const struct ndpi_iphdr *iph = NULL; #ifdef NDPI_DETECTION_SUPPORT_IPV6 const struct ndpi_ipv6hdr *iph_v6 = NULL; #endif u_int16_t l4len = 0; const u_int8_t *l4ptr = NULL; u_int8_t l4protocol = 0; if(l3 == NULL || l3_len < sizeof(struct ndpi_iphdr)) return 1; iph = (const struct ndpi_iphdr *) l3; if(iph->version == IPVERSION && iph->ihl >= 5) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv4 header\n"); } #ifdef NDPI_DETECTION_SUPPORT_IPV6 else if(iph->version == 6 && l3_len >= sizeof(struct ndpi_ipv6hdr)) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv6 header\n"); iph_v6 = (const struct ndpi_ipv6hdr *) iph; iph = NULL; } #endif else { return 1; } if((flags & NDPI_DETECTION_ONLY_IPV6) && iph != NULL) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv4 header found but excluded by flag\n"); return 1; } #ifdef NDPI_DETECTION_SUPPORT_IPV6 else if((flags & NDPI_DETECTION_ONLY_IPV4) && iph_v6 != NULL) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv6 header found but excluded by flag\n"); return 1; } #endif if(iph != NULL && ndpi_iph_is_valid_and_not_fragmented(iph, l3_len)) { u_int16_t len = ntohs(iph->tot_len); u_int16_t hlen = (iph->ihl * 4); l4ptr = (((const u_int8_t *) iph) + iph->ihl * 4); if(len == 0) len = l3_len; l4len = (len > hlen) ? (len - hlen) : 0; l4protocol = iph->protocol; } #ifdef NDPI_DETECTION_SUPPORT_IPV6 else if(iph_v6 != NULL && (l3_len - sizeof(struct ndpi_ipv6hdr)) >= ntohs(iph_v6->ip6_ctlun.ip6_un1.ip6_un1_plen)) { l4ptr = (((const u_int8_t *) iph_v6) + sizeof(struct ndpi_ipv6hdr)); l4len = ntohs(iph_v6->ip6_ctlun.ip6_un1.ip6_un1_plen); l4protocol = iph_v6->ip6_ctlun.ip6_un1.ip6_un1_nxt; // we need to handle IPv6 extension headers if present if(ndpi_handle_ipv6_extension_headers(ndpi_struct, &l4ptr, &l4len, &l4protocol) != 0) { return 1; } } #endif else { return 1; } if(l4_return != NULL) { *l4_return = l4ptr; } if(l4_len_return != NULL) { *l4_len_return = l4len; } if(l4_protocol_return != NULL) { *l4_protocol_return = l4protocol; } return 0; } void ndpi_apply_flow_protocol_to_packet(struct ndpi_flow_struct *flow, struct ndpi_packet_struct *packet) { memcpy(&packet->detected_protocol_stack, &flow->detected_protocol_stack, sizeof(packet->detected_protocol_stack)); memcpy(&packet->protocol_stack_info, &flow->protocol_stack_info, sizeof(packet->protocol_stack_info)); } static int ndpi_init_packet_header(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, unsigned short packetlen) { const struct ndpi_iphdr *decaps_iph = NULL; u_int16_t l3len; u_int16_t l4len; const u_int8_t *l4ptr; u_int8_t l4protocol; u_int8_t l4_result; if (flow) { /* reset payload_packet_len, will be set if ipv4 tcp or udp */ flow->packet.payload_packet_len = 0; flow->packet.l4_packet_len = 0; flow->packet.l3_packet_len = packetlen; flow->packet.tcp = NULL; flow->packet.udp = NULL; flow->packet.generic_l4_ptr = NULL; #ifdef NDPI_DETECTION_SUPPORT_IPV6 flow->packet.iphv6 = NULL; #endif /* NDPI_DETECTION_SUPPORT_IPV6 */ } if(flow) { ndpi_apply_flow_protocol_to_packet(flow, &flow->packet); } else { ndpi_int_reset_packet_protocol(&flow->packet); } l3len = flow->packet.l3_packet_len; #ifdef NDPI_DETECTION_SUPPORT_IPV6 if(flow->packet.iph != NULL) { #endif /* NDPI_DETECTION_SUPPORT_IPV6 */ decaps_iph =flow->packet.iph; #ifdef NDPI_DETECTION_SUPPORT_IPV6 } #endif /* NDPI_DETECTION_SUPPORT_IPV6 */ if(decaps_iph && decaps_iph->version == IPVERSION && decaps_iph->ihl >= 5) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv4 header\n"); } #ifdef NDPI_DETECTION_SUPPORT_IPV6 else if(decaps_iph && decaps_iph->version == 6 && l3len >= sizeof(struct ndpi_ipv6hdr) && (ndpi_struct->ip_version_limit & NDPI_DETECTION_ONLY_IPV4) == 0) { NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ipv6 header\n"); flow->packet.iphv6 = (struct ndpi_ipv6hdr *)flow->packet.iph; flow->packet.iph = NULL; } #endif else { flow->packet.iph = NULL; return 1; } /* needed: * - unfragmented packets * - ip header <= packet len * - ip total length >= packet len */ l4ptr = NULL; l4len = 0; l4protocol = 0; l4_result = ndpi_detection_get_l4_internal(ndpi_struct, (const u_int8_t *) decaps_iph, l3len, &l4ptr, &l4len, &l4protocol, 0); if(l4_result != 0) { return 1; } flow->packet.l4_protocol = l4protocol; flow->packet.l4_packet_len = l4len; /* tcp / udp detection */ if(l4protocol == IPPROTO_TCP && flow->packet.l4_packet_len >= 20 /* min size of tcp */ ) { /* tcp */ flow->packet.tcp = (struct ndpi_tcphdr *) l4ptr; if(flow->packet.l4_packet_len >=flow->packet.tcp->doff * 4) { flow->packet.payload_packet_len = flow->packet.l4_packet_len -flow->packet.tcp->doff * 4; flow->packet.actual_payload_len =flow->packet.payload_packet_len; flow->packet.payload = ((u_int8_t *)flow->packet.tcp) + (flow->packet.tcp->doff * 4); /* check for new tcp syn packets, here * idea: reset detection state if a connection is unknown */ if(flow && flow->packet.tcp->syn != 0 && flow->packet.tcp->ack == 0 && flow->init_finished != 0 && flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { memset(flow, 0, sizeof(*(flow))); NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "%s:%u: tcp syn packet for unknown protocol, reset detection state\n", __FUNCTION__, __LINE__); } } else { /* tcp header not complete */ flow->packet.tcp = NULL; } } else if(l4protocol == IPPROTO_UDP && flow->packet.l4_packet_len >= 8 /* size of udp */ ) { flow->packet.udp = (struct ndpi_udphdr *) l4ptr; flow->packet.payload_packet_len =flow->packet.l4_packet_len - 8; flow->packet.payload = ((u_int8_t *)flow->packet.udp) + 8; } else { flow->packet.generic_l4_ptr = l4ptr; } return 0; } void ndpi_connection_tracking(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { /* const for gcc code optimization and cleaner code */ struct ndpi_packet_struct *packet = &flow->packet; const struct ndpi_iphdr *iph = packet->iph; #ifdef NDPI_DETECTION_SUPPORT_IPV6 const struct ndpi_ipv6hdr *iphv6 = packet->iphv6; #endif const struct ndpi_tcphdr *tcph = packet->tcp; const struct ndpi_udphdr *udph = flow->packet.udp; u_int8_t proxy_enabled = 0; packet->tcp_retransmission = 0, packet->packet_direction = 0; if(ndpi_struct->direction_detect_disable) { packet->packet_direction = flow->packet_direction; } else { if(iph != NULL && iph->saddr < iph->daddr) packet->packet_direction = 1; #ifdef NDPI_DETECTION_SUPPORT_IPV6 if(iphv6 != NULL && NDPI_COMPARE_IPV6_ADDRESS_STRUCTS(&iphv6->ip6_src, &iphv6->ip6_dst) != 0) packet->packet_direction = 1; #endif } packet->packet_lines_parsed_complete = 0; if(flow == NULL) return; if(flow->init_finished == 0) { flow->init_finished = 1; flow->setup_packet_direction = packet->packet_direction; } if(tcph != NULL) { /* reset retried bytes here before setting it */ packet->num_retried_bytes = 0; if(!ndpi_struct->direction_detect_disable) packet->packet_direction = (tcph->source < tcph->dest) ? 1 : 0; if(tcph->syn != 0 && tcph->ack == 0 && flow->l4.tcp.seen_syn == 0 && flow->l4.tcp.seen_syn_ack == 0 && flow->l4.tcp.seen_ack == 0) { flow->l4.tcp.seen_syn = 1; } if(tcph->syn != 0 && tcph->ack != 0 && flow->l4.tcp.seen_syn == 1 && flow->l4.tcp.seen_syn_ack == 0 && flow->l4.tcp.seen_ack == 0) { flow->l4.tcp.seen_syn_ack = 1; } if(tcph->syn == 0 && tcph->ack == 1 && flow->l4.tcp.seen_syn == 1 && flow->l4.tcp.seen_syn_ack == 1 && flow->l4.tcp.seen_ack == 0) { flow->l4.tcp.seen_ack = 1; } if((flow->next_tcp_seq_nr[0] == 0 && flow->next_tcp_seq_nr[1] == 0) || (proxy_enabled && (flow->next_tcp_seq_nr[0] == 0 || flow->next_tcp_seq_nr[1] == 0))) { /* initialize tcp sequence counters */ /* the ack flag needs to be set to get valid sequence numbers from the other * direction. Usually it will catch the second packet syn+ack but it works * also for asymmetric traffic where it will use the first data packet * * if the syn flag is set add one to the sequence number, * otherwise use the payload length. */ if(tcph->ack != 0) { flow->next_tcp_seq_nr[flow->packet.packet_direction] = ntohl(tcph->seq) + (tcph->syn ? 1 : packet->payload_packet_len); if(!proxy_enabled) { flow->next_tcp_seq_nr[1 -flow->packet.packet_direction] = ntohl(tcph->ack_seq); } } } else if(packet->payload_packet_len > 0) { /* check tcp sequence counters */ if(((u_int32_t)(ntohl(tcph->seq) - flow->next_tcp_seq_nr[packet->packet_direction])) > ndpi_struct->tcp_max_retransmission_window_size) { packet->tcp_retransmission = 1; /* CHECK IF PARTIAL RETRY IS HAPPENING */ if((flow->next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq) < packet->payload_packet_len)) { /* num_retried_bytes actual_payload_len hold info about the partial retry analyzer which require this info can make use of this info Other analyzer can use packet->payload_packet_len */ packet->num_retried_bytes = (u_int16_t)(flow->next_tcp_seq_nr[packet->packet_direction] - ntohl(tcph->seq)); packet->actual_payload_len = packet->payload_packet_len - packet->num_retried_bytes; flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len; } } /* normal path actual_payload_len is initialized to payload_packet_len during tcp header parsing itself. It will be changed only in case of retransmission */ else { packet->num_retried_bytes = 0; flow->next_tcp_seq_nr[packet->packet_direction] = ntohl(tcph->seq) + packet->payload_packet_len; } } if(tcph->rst) { flow->next_tcp_seq_nr[0] = 0; flow->next_tcp_seq_nr[1] = 0; } } else if(udph != NULL) { if(!ndpi_struct->direction_detect_disable) packet->packet_direction = (udph->source < udph->dest) ? 1 : 0; } if(flow->packet_counter < MAX_PACKET_COUNTER && packet->payload_packet_len) { flow->packet_counter++; } if(flow->packet_direction_counter[packet->packet_direction] < MAX_PACKET_COUNTER && packet->payload_packet_len) { flow->packet_direction_counter[packet->packet_direction]++; } if(flow->byte_counter[packet->packet_direction] + packet->payload_packet_len > flow->byte_counter[packet->packet_direction]) { flow->byte_counter[packet->packet_direction] += packet->payload_packet_len; } } void check_ndpi_other_flow_func(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, NDPI_SELECTION_BITMASK_PROTOCOL_SIZE *ndpi_selection_packet) { void *func = NULL; u_int32_t a; u_int16_t proto_index = ndpi_struct->proto_defaults[flow->guessed_protocol_id].protoIdx; int16_t proto_id = ndpi_struct->proto_defaults[flow->guessed_protocol_id].protoId; NDPI_PROTOCOL_BITMASK detection_bitmask; NDPI_SAVE_AS_BITMASK(detection_bitmask, flow->packet.detected_protocol_stack[0]); if((proto_id != NDPI_PROTOCOL_UNKNOWN) && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ndpi_struct->callback_buffer[proto_index].excluded_protocol_bitmask) == 0 && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer[proto_index].detection_bitmask, detection_bitmask) != 0 && (ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask) { if((flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) && (ndpi_struct->proto_defaults[flow->guessed_protocol_id].func != NULL)) ndpi_struct->proto_defaults[flow->guessed_protocol_id].func(ndpi_struct, flow), func = ndpi_struct->proto_defaults[flow->guessed_protocol_id].func; } for(a = 0; a < ndpi_struct->callback_buffer_size_non_tcp_udp; a++) { if((func != ndpi_struct->callback_buffer_non_tcp_udp[a].func) && (ndpi_struct->callback_buffer_non_tcp_udp[a].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer_non_tcp_udp[a].ndpi_selection_bitmask && (flow == NULL || NDPI_BITMASK_COMPARE (flow->excluded_protocol_bitmask, ndpi_struct->callback_buffer_non_tcp_udp[a].excluded_protocol_bitmask) == 0) && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_non_tcp_udp[a].detection_bitmask, detection_bitmask) != 0) { if(ndpi_struct->callback_buffer_non_tcp_udp[a].func != NULL) ndpi_struct->callback_buffer_non_tcp_udp[a].func(ndpi_struct, flow); if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) break; /* Stop after detecting the first protocol */ } } } void check_ndpi_udp_flow_func(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, NDPI_SELECTION_BITMASK_PROTOCOL_SIZE *ndpi_selection_packet) { void *func = NULL; u_int32_t a; u_int16_t proto_index = ndpi_struct->proto_defaults[flow->guessed_protocol_id].protoIdx; int16_t proto_id = ndpi_struct->proto_defaults[flow->guessed_protocol_id].protoId; NDPI_PROTOCOL_BITMASK detection_bitmask; NDPI_SAVE_AS_BITMASK(detection_bitmask, flow->packet.detected_protocol_stack[0]); if((proto_id != NDPI_PROTOCOL_UNKNOWN) && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ndpi_struct->callback_buffer[proto_index].excluded_protocol_bitmask) == 0 && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer[proto_index].detection_bitmask, detection_bitmask) != 0 && (ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask) { if((flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) && (ndpi_struct->proto_defaults[flow->guessed_protocol_id].func != NULL)) ndpi_struct->proto_defaults[flow->guessed_protocol_id].func(ndpi_struct, flow), func = ndpi_struct->proto_defaults[flow->guessed_protocol_id].func; } for(a = 0; a < ndpi_struct->callback_buffer_size_udp; a++) { if((func != ndpi_struct->callback_buffer_udp[a].func) && (ndpi_struct->callback_buffer_udp[a].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer_udp[a].ndpi_selection_bitmask && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ndpi_struct->callback_buffer_udp[a].excluded_protocol_bitmask) == 0 && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_udp[a].detection_bitmask, detection_bitmask) != 0) { ndpi_struct->callback_buffer_udp[a].func(ndpi_struct, flow); // NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "[UDP,CALL] dissector of protocol as callback_buffer idx = %d\n",a); if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) break; /* Stop after detecting the first protocol */ } else NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "[UDP,SKIP] dissector of protocol as callback_buffer idx = %d\n",a); } } void check_ndpi_tcp_flow_func(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, NDPI_SELECTION_BITMASK_PROTOCOL_SIZE *ndpi_selection_packet) { void *func = NULL; u_int32_t a; u_int16_t proto_index = ndpi_struct->proto_defaults[flow->guessed_protocol_id].protoIdx; int16_t proto_id = ndpi_struct->proto_defaults[flow->guessed_protocol_id].protoId; NDPI_PROTOCOL_BITMASK detection_bitmask; NDPI_SAVE_AS_BITMASK(detection_bitmask, flow->packet.detected_protocol_stack[0]); if(flow->packet.payload_packet_len != 0) { if((proto_id != NDPI_PROTOCOL_UNKNOWN) && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ndpi_struct->callback_buffer[proto_index].excluded_protocol_bitmask) == 0 && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer[proto_index].detection_bitmask, detection_bitmask) != 0 && (ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask) { if((flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) && (ndpi_struct->proto_defaults[flow->guessed_protocol_id].func != NULL)) ndpi_struct->proto_defaults[flow->guessed_protocol_id].func(ndpi_struct, flow), func = ndpi_struct->proto_defaults[flow->guessed_protocol_id].func; } if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { for(a = 0; a < ndpi_struct->callback_buffer_size_tcp_payload; a++) { if((func != ndpi_struct->callback_buffer_tcp_payload[a].func) && (ndpi_struct->callback_buffer_tcp_payload[a].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer_tcp_payload[a].ndpi_selection_bitmask && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ndpi_struct->callback_buffer_tcp_payload[a].excluded_protocol_bitmask) == 0 && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_tcp_payload[a].detection_bitmask, detection_bitmask) != 0) { ndpi_struct->callback_buffer_tcp_payload[a].func(ndpi_struct, flow); if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) break; /* Stop after detecting the first protocol */ } } } } else { /* no payload */ if((proto_id != NDPI_PROTOCOL_UNKNOWN) && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ndpi_struct->callback_buffer[proto_index].excluded_protocol_bitmask) == 0 && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer[proto_index].detection_bitmask, detection_bitmask) != 0 && (ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer[proto_index].ndpi_selection_bitmask) { if((flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) && (ndpi_struct->proto_defaults[flow->guessed_protocol_id].func != NULL) && ((ndpi_struct->callback_buffer[flow->guessed_protocol_id].ndpi_selection_bitmask & NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD) == 0)) ndpi_struct->proto_defaults[flow->guessed_protocol_id].func(ndpi_struct, flow), func = ndpi_struct->proto_defaults[flow->guessed_protocol_id].func; } for(a = 0; a < ndpi_struct->callback_buffer_size_tcp_no_payload; a++) { if((func != ndpi_struct->callback_buffer_tcp_payload[a].func) && (ndpi_struct->callback_buffer_tcp_no_payload[a].ndpi_selection_bitmask & *ndpi_selection_packet) == ndpi_struct->callback_buffer_tcp_no_payload[a].ndpi_selection_bitmask && NDPI_BITMASK_COMPARE(flow->excluded_protocol_bitmask, ndpi_struct-> callback_buffer_tcp_no_payload[a].excluded_protocol_bitmask) == 0 && NDPI_BITMASK_COMPARE(ndpi_struct->callback_buffer_tcp_no_payload[a].detection_bitmask, detection_bitmask) != 0) { ndpi_struct->callback_buffer_tcp_no_payload[a].func(ndpi_struct, flow); if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) break; /* Stop after detecting the first protocol */ } } } } void check_ndpi_flow_func(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, NDPI_SELECTION_BITMASK_PROTOCOL_SIZE *ndpi_selection_packet) { if(flow->packet.tcp != NULL) check_ndpi_tcp_flow_func(ndpi_struct, flow, ndpi_selection_packet); else if(flow->packet.udp != NULL) check_ndpi_udp_flow_func(ndpi_struct, flow, ndpi_selection_packet); else check_ndpi_other_flow_func(ndpi_struct, flow, ndpi_selection_packet); } /* ********************************************************************************* */ ndpi_protocol ndpi_detection_giveup(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_protocol ret = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN }; if(flow == NULL) return(ret); /* TODO: add the remaining stage_XXXX protocols */ if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { u_int16_t guessed_protocol_id, guessed_host_protocol_id; if(flow->protos.ssl.client_certificate[0] != '\0') { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSL, NDPI_PROTOCOL_UNKNOWN); } else { if((flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN) && (flow->packet.l4_protocol == IPPROTO_TCP) && (flow->l4.tcp.ssl_stage > 1)) flow->guessed_protocol_id = NDPI_PROTOCOL_SSL; guessed_protocol_id = flow->guessed_protocol_id, guessed_host_protocol_id = flow->guessed_host_protocol_id; if((guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) && (NDPI_ISSET(&flow->excluded_protocol_bitmask, guessed_host_protocol_id))) guessed_host_protocol_id = NDPI_PROTOCOL_UNKNOWN; /* Ignore guessed protocol if they have been discarded */ if((guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) && (guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) && (NDPI_ISSET(&flow->excluded_protocol_bitmask, guessed_protocol_id))) guessed_protocol_id = NDPI_PROTOCOL_UNKNOWN; if((guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) || (guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN)) { ndpi_int_change_protocol(ndpi_struct, flow, guessed_host_protocol_id, guessed_protocol_id); } } } else { flow->detected_protocol_stack[1] = flow->guessed_protocol_id, flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; if(flow->detected_protocol_stack[1] == flow->detected_protocol_stack[0]) flow->detected_protocol_stack[1] = flow->guessed_host_protocol_id; } if((flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) && (flow->num_stun_udp_pkts > 0)) ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STUN, flow->guessed_host_protocol_id); ret.master_protocol = flow->detected_protocol_stack[1], ret.app_protocol = flow->detected_protocol_stack[0]; return(ret); } /* ********************************************************************************* */ void ndpi_process_extra_packet(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const unsigned char *packet, const unsigned short packetlen, const u_int64_t current_tick_l, struct ndpi_id_struct *src, struct ndpi_id_struct *dst) { if(flow == NULL) return; if(flow->server_id == NULL) flow->server_id = dst; /* Default */ /* need at least 20 bytes for ip header */ if(packetlen < 20) { return; } flow->packet.tick_timestamp_l = current_tick_l; flow->packet.tick_timestamp = (u_int32_t)current_tick_l/1000; /* parse packet */ flow->packet.iph = (struct ndpi_iphdr *)packet; /* we are interested in ipv4 packet */ /* set up the packet headers for the extra packet function to use if it wants */ if(ndpi_init_packet_header(ndpi_struct, flow, packetlen) != 0) return; /* detect traffic for tcp or udp only */ flow->src = src, flow->dst = dst; ndpi_connection_tracking(ndpi_struct, flow); /* call the extra packet function (which may add more data/info to flow) */ if (flow->extra_packets_func) { if ((flow->extra_packets_func(ndpi_struct, flow)) == 0) flow->check_extra_packets = 0; } flow->num_extra_packets_checked++; } /* ********************************************************************************* */ ndpi_protocol ndpi_detection_process_packet(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const unsigned char *packet, const unsigned short packetlen, const u_int64_t current_tick_l, struct ndpi_id_struct *src, struct ndpi_id_struct *dst) { NDPI_SELECTION_BITMASK_PROTOCOL_SIZE ndpi_selection_packet; u_int32_t a; ndpi_protocol ret = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN }; if(flow == NULL) return(ret); if(flow->server_id == NULL) flow->server_id = dst; /* Default */ if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) goto ret_protocols; /* need at least 20 bytes for ip header */ if(packetlen < 20) { /* reset protocol which is normally done in init_packet_header */ ndpi_int_reset_packet_protocol(&flow->packet); return(ret); } flow->packet.tick_timestamp_l = current_tick_l; flow->packet.tick_timestamp = (u_int32_t)current_tick_l/1000; /* parse packet */ flow->packet.iph = (struct ndpi_iphdr *)packet; /* we are interested in ipv4 packet */ if(ndpi_init_packet_header(ndpi_struct, flow, packetlen) != 0) return(ret); /* detect traffic for tcp or udp only */ flow->src = src, flow->dst = dst; ndpi_connection_tracking(ndpi_struct, flow); /* build ndpi_selection packet bitmask */ ndpi_selection_packet = NDPI_SELECTION_BITMASK_PROTOCOL_COMPLETE_TRAFFIC; if(flow->packet.iph != NULL) ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_IP | NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6; if(flow->packet.tcp != NULL) ndpi_selection_packet |= (NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP); if(flow->packet.udp != NULL) ndpi_selection_packet |= (NDPI_SELECTION_BITMASK_PROTOCOL_INT_UDP | NDPI_SELECTION_BITMASK_PROTOCOL_INT_TCP_OR_UDP); if(flow->packet.payload_packet_len != 0) ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_HAS_PAYLOAD; if(flow->packet.tcp_retransmission == 0) ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_NO_TCP_RETRANSMISSION; #ifdef NDPI_DETECTION_SUPPORT_IPV6 if(flow->packet.iphv6 != NULL) ndpi_selection_packet |= NDPI_SELECTION_BITMASK_PROTOCOL_IPV6 | NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6; #endif /* NDPI_DETECTION_SUPPORT_IPV6 */ if((!flow->protocol_id_already_guessed) && ( #ifdef NDPI_DETECTION_SUPPORT_IPV6 flow->packet.iphv6 || #endif flow->packet.iph)) { u_int16_t sport, dport; u_int8_t protocol; u_int8_t user_defined_proto; flow->protocol_id_already_guessed = 1; #ifdef NDPI_DETECTION_SUPPORT_IPV6 if(flow->packet.iphv6 != NULL) { protocol = flow->packet.iphv6->ip6_ctlun.ip6_un1.ip6_un1_nxt; } else #endif { protocol = flow->packet.iph->protocol; } if(flow->packet.udp) sport = ntohs(flow->packet.udp->source), dport = ntohs(flow->packet.udp->dest); else if(flow->packet.tcp) sport = ntohs(flow->packet.tcp->source), dport = ntohs(flow->packet.tcp->dest); else sport = dport = 0; /* guess protocol */ flow->guessed_protocol_id = (int16_t) ndpi_guess_protocol_id(ndpi_struct, protocol, sport, dport, &user_defined_proto); if(flow->guessed_protocol_id >= (NDPI_MAX_SUPPORTED_PROTOCOLS-1)) { /* This is a custom protocol and it has priority over everything else */ ret.master_protocol = NDPI_PROTOCOL_UNKNOWN, ret.app_protocol = flow->guessed_host_protocol_id; return(ret); } if(user_defined_proto && flow->guessed_protocol_id != NDPI_PROTOCOL_UNKNOWN) { if(flow->packet.iph) { /* guess host protocol */ flow->guessed_host_protocol_id = ndpi_network_ptree_match(ndpi_struct, (struct in_addr *)&flow->packet.iph->saddr); if(flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) flow->guessed_host_protocol_id = ndpi_network_ptree_match(ndpi_struct, (struct in_addr *)&flow->packet.iph->daddr); if(flow->guessed_host_protocol_id != NDPI_PROTOCOL_UNKNOWN) /* ret.master_protocol = flow->guessed_protocol_id , ret.app_protocol = flow->guessed_host_protocol_id; /\* ****** *\/ */ ret = ndpi_detection_giveup(ndpi_struct, flow); return(ret); } } else { /* guess host protocol */ if(flow->packet.iph) { flow->guessed_host_protocol_id = ndpi_network_ptree_match(ndpi_struct, (struct in_addr *)&flow->packet.iph->saddr); if(flow->guessed_host_protocol_id == NDPI_PROTOCOL_UNKNOWN) flow->guessed_host_protocol_id = ndpi_network_ptree_match(ndpi_struct, (struct in_addr *)&flow->packet.iph->daddr); } } } if(flow->guessed_host_protocol_id >= (NDPI_MAX_SUPPORTED_PROTOCOLS-1)) { /* This is a custom protocol and it has priority over everything else */ ret.master_protocol = NDPI_PROTOCOL_UNKNOWN, ret.app_protocol = flow->guessed_host_protocol_id; return(ret); } check_ndpi_flow_func(ndpi_struct, flow, &ndpi_selection_packet); a = flow->packet.detected_protocol_stack[0]; if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask, a) == 0) a = NDPI_PROTOCOL_UNKNOWN; if(a != NDPI_PROTOCOL_UNKNOWN) { int i; for(i=0; (ihost_server_name)) && (flow->host_server_name[i] != '\0'); i++) flow->host_server_name[i] = tolower(flow->host_server_name[i]); flow->host_server_name[i] ='\0'; } ret_protocols: if(flow->detected_protocol_stack[1] != NDPI_PROTOCOL_UNKNOWN) { ret.master_protocol = flow->detected_protocol_stack[1], ret.app_protocol = flow->detected_protocol_stack[0]; if(ret.app_protocol == ret.master_protocol) ret.master_protocol = NDPI_PROTOCOL_UNKNOWN; } else ret.app_protocol = flow->detected_protocol_stack[0]; return(ret); } u_int32_t ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read) { u_int32_t val; val = 0; // cancel if eof, ' ' or line end chars are reached while (*str >= '0' && *str <= '9' && max_chars_to_read > 0) { val *= 10; val += *str - '0'; str++; max_chars_to_read = max_chars_to_read - 1; *bytes_read = *bytes_read + 1; } return (val); } u_int32_t ndpi_bytestream_dec_or_hex_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read) { u_int32_t val; val = 0; if(max_chars_to_read <= 2 || str[0] != '0' || str[1] != 'x') { return ndpi_bytestream_to_number(str, max_chars_to_read, bytes_read); } else { /*use base 16 system */ str += 2; max_chars_to_read -= 2; *bytes_read = *bytes_read + 2; while (max_chars_to_read > 0) { if(*str >= '0' && *str <= '9') { val *= 16; val += *str - '0'; } else if(*str >= 'a' && *str <= 'f') { val *= 16; val += *str + 10 - 'a'; } else if(*str >= 'A' && *str <= 'F') { val *= 16; val += *str + 10 - 'A'; } else { break; } str++; max_chars_to_read = max_chars_to_read - 1; *bytes_read = *bytes_read + 1; } } return (val); } u_int64_t ndpi_bytestream_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read) { u_int64_t val; val = 0; // cancel if eof, ' ' or line end chars are reached while (max_chars_to_read > 0 && *str >= '0' && *str <= '9') { val *= 10; val += *str - '0'; str++; max_chars_to_read = max_chars_to_read - 1; *bytes_read = *bytes_read + 1; } return (val); } u_int64_t ndpi_bytestream_dec_or_hex_to_number64(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read) { u_int64_t val; val = 0; if(max_chars_to_read <= 2 || str[0] != '0' || str[1] != 'x') { return ndpi_bytestream_to_number64(str, max_chars_to_read, bytes_read); } else { /*use base 16 system */ str += 2; max_chars_to_read -= 2; *bytes_read = *bytes_read + 2; while (max_chars_to_read > 0) { if(*str >= '0' && *str <= '9') { val *= 16; val += *str - '0'; } else if(*str >= 'a' && *str <= 'f') { val *= 16; val += *str + 10 - 'a'; } else if(*str >= 'A' && *str <= 'F') { val *= 16; val += *str + 10 - 'A'; } else { break; } str++; max_chars_to_read = max_chars_to_read - 1; *bytes_read = *bytes_read + 1; } } return (val); } u_int32_t ndpi_bytestream_to_ipv4(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read) { u_int32_t val; u_int16_t read = 0; u_int16_t oldread; u_int32_t c; /* ip address must be X.X.X.X with each X between 0 and 255 */ oldread = read; c = ndpi_bytestream_to_number(str, max_chars_to_read, &read); if(c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.') return 0; read++; val = c << 24; oldread = read; c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read); if(c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.') return 0; read++; val = val + (c << 16); oldread = read; c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read); if(c > 255 || oldread == read || max_chars_to_read == read || str[read] != '.') return 0; read++; val = val + (c << 8); oldread = read; c = ndpi_bytestream_to_number(&str[read], max_chars_to_read - read, &read); if(c > 255 || oldread == read || max_chars_to_read == read) return 0; val = val + c; *bytes_read = *bytes_read + read; return htonl(val); } /* internal function for every detection to parse one packet and to increase the info buffer */ void ndpi_parse_packet_line_info(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { u_int32_t a; struct ndpi_packet_struct *packet = &flow->packet; u_int16_t end = packet->payload_packet_len - 1; if(packet->packet_lines_parsed_complete != 0) return; packet->packet_lines_parsed_complete = 1; packet->parsed_lines = 0; packet->empty_line_position_set = 0; packet->host_line.ptr = NULL; packet->host_line.len = 0; packet->referer_line.ptr = NULL; packet->referer_line.len = 0; packet->content_line.ptr = NULL; packet->content_line.len = 0; packet->accept_line.ptr = NULL; packet->accept_line.len = 0; packet->user_agent_line.ptr = NULL; packet->user_agent_line.len = 0; packet->http_url_name.ptr = NULL; packet->http_url_name.len = 0; packet->http_encoding.ptr = NULL; packet->http_encoding.len = 0; packet->http_transfer_encoding.ptr = NULL; packet->http_transfer_encoding.len = 0; packet->http_contentlen.ptr = NULL; packet->http_contentlen.len = 0; packet->http_cookie.ptr = NULL; packet->http_cookie.len = 0; packet->http_origin.len = 0; packet->http_origin.ptr = NULL; packet->http_x_session_type.ptr = NULL; packet->http_x_session_type.len = 0; packet->server_line.ptr = NULL; packet->server_line.len = 0; packet->http_method.ptr = NULL; packet->http_method.len = 0; packet->http_response.ptr = NULL; packet->http_response.len = 0; packet->http_num_headers=0; if((packet->payload_packet_len == 0) || (packet->payload == NULL) || (end == 0)) return; packet->line[packet->parsed_lines].ptr = packet->payload; packet->line[packet->parsed_lines].len = 0; for(a = 0; a < end-1 /* This because get_u_int16_t(packet->payload, a) reads 2 bytes */; a++) { if(get_u_int16_t(packet->payload, a) == ntohs(0x0d0a)) { /* If end of line char sequence CR+NL "\r\n", process line */ packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); /* First line of a HTTP response parsing. Expected a "HTTP/1.? ???" */ if(packet->parsed_lines == 0 && packet->line[0].len >= NDPI_STATICSTRING_LEN("HTTP/1.X 200 ") && strncasecmp((const char *)packet->line[0].ptr, "HTTP/1.", NDPI_STATICSTRING_LEN("HTTP/1.")) == 0 && packet->line[0].ptr[NDPI_STATICSTRING_LEN("HTTP/1.X ")] > '0' && /* response code between 000 and 699 */ packet->line[0].ptr[NDPI_STATICSTRING_LEN("HTTP/1.X ")] < '6') { packet->http_response.ptr = &packet->line[0].ptr[NDPI_STATICSTRING_LEN("HTTP/1.1 ")]; packet->http_response.len = packet->line[0].len - NDPI_STATICSTRING_LEN("HTTP/1.1 "); packet->http_num_headers++; /* Set server HTTP response code */ strncpy((char*)flow->http.response_status_code, (char*)packet->http_response.ptr, 3); flow->http.response_status_code[4]='\0'; NDPI_LOG(NDPI_PROTOCOL_UNKNOWN, ndpi_struct, NDPI_LOG_DEBUG, "ndpi_parse_packet_line_info: HTTP response parsed: \"%.*s\"\n", packet->http_response.len, packet->http_response.ptr); } /* "Server:" header line in HTTP response */ if(packet->line[packet->parsed_lines].len > NDPI_STATICSTRING_LEN("Server:") + 1 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Server:", NDPI_STATICSTRING_LEN("Server:")) == 0) { // some stupid clients omit a space and place the servername directly after the colon if(packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:")] == ' ') { packet->server_line.ptr = &packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:") + 1]; packet->server_line.len = packet->line[packet->parsed_lines].len - (NDPI_STATICSTRING_LEN("Server:") + 1); } else { packet->server_line.ptr = &packet->line[packet->parsed_lines].ptr[NDPI_STATICSTRING_LEN("Server:")]; packet->server_line.len = packet->line[packet->parsed_lines].len - NDPI_STATICSTRING_LEN("Server:"); } packet->http_num_headers++; } /* "Host:" header line in HTTP request */ if(packet->line[packet->parsed_lines].len > 6 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Host:", 5) == 0) { // some stupid clients omit a space and place the hostname directly after the colon if(packet->line[packet->parsed_lines].ptr[5] == ' ') { packet->host_line.ptr = &packet->line[packet->parsed_lines].ptr[6]; packet->host_line.len = packet->line[packet->parsed_lines].len - 6; } else { packet->host_line.ptr = &packet->line[packet->parsed_lines].ptr[5]; packet->host_line.len = packet->line[packet->parsed_lines].len - 5; } packet->http_num_headers++; } /* "X-Forwarded-For:" header line in HTTP request. Commonly used for HTTP proxies. */ if(packet->line[packet->parsed_lines].len > 17 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "X-Forwarded-For:", 16) == 0) { // some stupid clients omit a space and place the hostname directly after the colon if(packet->line[packet->parsed_lines].ptr[16] == ' ') { packet->forwarded_line.ptr = &packet->line[packet->parsed_lines].ptr[17]; packet->forwarded_line.len = packet->line[packet->parsed_lines].len - 17; } else { packet->forwarded_line.ptr = &packet->line[packet->parsed_lines].ptr[16]; packet->forwarded_line.len = packet->line[packet->parsed_lines].len - 16; } packet->http_num_headers++; } /* "Content-Type:" header line in HTTP. */ if(packet->line[packet->parsed_lines].len > 14 && (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Type: ", 14) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-type: ", 14) == 0)) { packet->content_line.ptr = &packet->line[packet->parsed_lines].ptr[14]; packet->content_line.len = packet->line[packet->parsed_lines].len - 14; packet->http_num_headers++; } /* "Content-Type:" header line in HTTP AGAIN. Probably a bogus response without space after ":" */ if(packet->line[packet->parsed_lines].len > 13 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-type:", 13) == 0) { packet->content_line.ptr = &packet->line[packet->parsed_lines].ptr[13]; packet->content_line.len = packet->line[packet->parsed_lines].len - 13; packet->http_num_headers++; } /* "Accept:" header line in HTTP request. */ if(packet->line[packet->parsed_lines].len > 8 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Accept: ", 8) == 0) { packet->accept_line.ptr = &packet->line[packet->parsed_lines].ptr[8]; packet->accept_line.len = packet->line[packet->parsed_lines].len - 8; packet->http_num_headers++; } /* "Referer:" header line in HTTP request. */ if(packet->line[packet->parsed_lines].len > 9 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Referer: ", 9) == 0) { packet->referer_line.ptr = &packet->line[packet->parsed_lines].ptr[9]; packet->referer_line.len = packet->line[packet->parsed_lines].len - 9; packet->http_num_headers++; } /* "User-Agent:" header line in HTTP request. */ if(packet->line[packet->parsed_lines].len > 12 && (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "User-Agent: ", 12) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "User-agent: ", 12) == 0)) { packet->user_agent_line.ptr = &packet->line[packet->parsed_lines].ptr[12]; packet->user_agent_line.len = packet->line[packet->parsed_lines].len - 12; packet->http_num_headers++; } /* "Content-Encoding:" header line in HTTP response (and request?). */ if(packet->line[packet->parsed_lines].len > 18 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Encoding: ", 18) == 0) { packet->http_encoding.ptr = &packet->line[packet->parsed_lines].ptr[18]; packet->http_encoding.len = packet->line[packet->parsed_lines].len - 18; packet->http_num_headers++; } /* "Transfer-Encoding:" header line in HTTP. */ if(packet->line[packet->parsed_lines].len > 19 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Transfer-Encoding: ", 19) == 0) { packet->http_transfer_encoding.ptr = &packet->line[packet->parsed_lines].ptr[19]; packet->http_transfer_encoding.len = packet->line[packet->parsed_lines].len - 19; packet->http_num_headers++; } /* "Content-Length:" header line in HTTP. */ if(packet->line[packet->parsed_lines].len > 16 && ((strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Content-Length: ", 16) == 0) || (strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "content-length: ", 16) == 0))) { packet->http_contentlen.ptr = &packet->line[packet->parsed_lines].ptr[16]; packet->http_contentlen.len = packet->line[packet->parsed_lines].len - 16; packet->http_num_headers++; } /* "Cookie:" header line in HTTP. */ if(packet->line[packet->parsed_lines].len > 8 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Cookie: ", 8) == 0) { packet->http_cookie.ptr = &packet->line[packet->parsed_lines].ptr[8]; packet->http_cookie.len = packet->line[packet->parsed_lines].len - 8; packet->http_num_headers++; } /* "Origin:" header line in HTTP. */ if(packet->line[packet->parsed_lines].len > 8 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Origin: ", 8) == 0) { packet->http_origin.ptr = &packet->line[packet->parsed_lines].ptr[8]; packet->http_origin.len = packet->line[packet->parsed_lines].len - 8; packet->http_num_headers++; } /* "X-Session-Type:" header line in HTTP. */ if(packet->line[packet->parsed_lines].len > 16 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "X-Session-Type: ", 16) == 0) { packet->http_x_session_type.ptr = &packet->line[packet->parsed_lines].ptr[16]; packet->http_x_session_type.len = packet->line[packet->parsed_lines].len - 16; packet->http_num_headers++; } /* Identification and counting of other HTTP headers. * We consider the most common headers, but there are many others, * which can be seen at references below: * - https://tools.ietf.org/html/rfc7230 * - https://en.wikipedia.org/wiki/List_of_HTTP_header_fields */ if((packet->line[packet->parsed_lines].len > 6 && ( strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Date: ", 6) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Vary: ", 6) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "ETag: ", 6) == 0 )) || (packet->line[packet->parsed_lines].len > 8 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Pragma: ", 8) == 0) || (packet->line[packet->parsed_lines].len > 9 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Expires: ", 9) == 0) || (packet->line[packet->parsed_lines].len > 12 && ( strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Set-Cookie: ", 12) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Keep-Alive: ", 12) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Connection: ", 12) == 0)) || (packet->line[packet->parsed_lines].len > 15 && ( strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Last-Modified: ", 15) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Accept-Ranges: ", 15) == 0)) || (packet->line[packet->parsed_lines].len > 17 && ( strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Accept-Language: ", 17) == 0 || strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Accept-Encoding: ", 17) == 0)) || (packet->line[packet->parsed_lines].len > 27 && strncasecmp((const char *)packet->line[packet->parsed_lines].ptr, "Upgrade-Insecure-Requests: ", 27) == 0)) { /* Just count. In the future, if needed, this if can be splited to parse these headers */ packet->http_num_headers++; } if(packet->line[packet->parsed_lines].len == 0) { packet->empty_line_position = a; packet->empty_line_position_set = 1; } if(packet->parsed_lines >= (NDPI_MAX_PARSE_LINES_PER_PACKET - 1)) return; packet->parsed_lines++; packet->line[packet->parsed_lines].ptr = &packet->payload[a + 2]; packet->line[packet->parsed_lines].len = 0; if((a + 2) >= packet->payload_packet_len) return; a++; /* next char in the payload */ } } if(packet->parsed_lines >= 1) { packet->line[packet->parsed_lines].len = (u_int16_t)(((unsigned long) &packet->payload[packet->payload_packet_len]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); packet->parsed_lines++; } } void ndpi_parse_packet_line_info_any(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t a; u_int16_t end = packet->payload_packet_len; if(packet->packet_lines_parsed_complete != 0) return; packet->packet_lines_parsed_complete = 1; packet->parsed_lines = 0; if(packet->payload_packet_len == 0) return; packet->line[packet->parsed_lines].ptr = packet->payload; packet->line[packet->parsed_lines].len = 0; for(a = 0; a < end; a++) { if(packet->payload[a] == 0x0a) { packet->line[packet->parsed_lines].len = (u_int16_t)( ((unsigned long) &packet->payload[a]) - ((unsigned long) packet->line[packet->parsed_lines].ptr)); if(a > 0 && packet->payload[a-1] == 0x0d) packet->line[packet->parsed_lines].len--; if(packet->parsed_lines >= (NDPI_MAX_PARSE_LINES_PER_PACKET - 1)) break; packet->parsed_lines++; packet->line[packet->parsed_lines].ptr = &packet->payload[a + 1]; packet->line[packet->parsed_lines].len = 0; if((a + 1) >= packet->payload_packet_len) break; //a++; } } } u_int16_t ndpi_check_for_email_address(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t counter) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "called ndpi_check_for_email_address\n"); if(packet->payload_packet_len > counter && ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z') || (packet->payload[counter] >= 'A' && packet->payload[counter] <= 'Z') || (packet->payload[counter] >= '0' && packet->payload[counter] <= '9') || packet->payload[counter] == '-' || packet->payload[counter] == '_')) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "first letter\n"); counter++; while (packet->payload_packet_len > counter && ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z') || (packet->payload[counter] >= 'A' && packet->payload[counter] <= 'Z') || (packet->payload[counter] >= '0' && packet->payload[counter] <= '9') || packet->payload[counter] == '-' || packet->payload[counter] == '_' || packet->payload[counter] == '.')) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "further letter\n"); counter++; if(packet->payload_packet_len > counter && packet->payload[counter] == '@') { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "@\n"); counter++; while (packet->payload_packet_len > counter && ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z') || (packet->payload[counter] >= 'A' && packet->payload[counter] <= 'Z') || (packet->payload[counter] >= '0' && packet->payload[counter] <= '9') || packet->payload[counter] == '-' || packet->payload[counter] == '_')) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "letter\n"); counter++; if(packet->payload_packet_len > counter && packet->payload[counter] == '.') { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, ".\n"); counter++; if(packet->payload_packet_len > counter + 1 && ((packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z') && (packet->payload[counter + 1] >= 'a' && packet->payload[counter + 1] <= 'z'))) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "two letters\n"); counter += 2; if(packet->payload_packet_len > counter && (packet->payload[counter] == ' ' || packet->payload[counter] == ';')) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "whitespace1\n"); return counter; } else if(packet->payload_packet_len > counter && packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z') { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "one letter\n"); counter++; if(packet->payload_packet_len > counter && (packet->payload[counter] == ' ' || packet->payload[counter] == ';')) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "whitespace2\n"); return counter; } else if(packet->payload_packet_len > counter && packet->payload[counter] >= 'a' && packet->payload[counter] <= 'z') { counter++; if(packet->payload_packet_len > counter && (packet->payload[counter] == ' ' || packet->payload[counter] == ';')) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "whitespace3\n"); return counter; } else { return 0; } } else { return 0; } } else { return 0; } } else { return 0; } } } return 0; } } } return 0; } #ifdef NDPI_ENABLE_DEBUG_MESSAGES void ndpi_debug_get_last_log_function_line(struct ndpi_detection_module_struct *ndpi_struct, const char **file, const char **func, u_int32_t * line) { *file = ""; *func = ""; if(ndpi_struct->ndpi_debug_print_file != NULL) *file = ndpi_struct->ndpi_debug_print_file; if(ndpi_struct->ndpi_debug_print_function != NULL) *func = ndpi_struct->ndpi_debug_print_function; *line = ndpi_struct->ndpi_debug_print_line; } #endif u_int8_t ndpi_detection_get_l4(const u_int8_t * l3, u_int16_t l3_len, const u_int8_t ** l4_return, u_int16_t * l4_len_return, u_int8_t * l4_protocol_return, u_int32_t flags) { return ndpi_detection_get_l4_internal(NULL, l3, l3_len, l4_return, l4_len_return, l4_protocol_return, flags); } void ndpi_set_detected_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t upper_detected_protocol, u_int16_t lower_detected_protocol) { struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; ndpi_int_change_protocol(ndpi_struct, flow, upper_detected_protocol, lower_detected_protocol); if(src != NULL) { NDPI_ADD_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, upper_detected_protocol); if(lower_detected_protocol != NDPI_PROTOCOL_UNKNOWN) NDPI_ADD_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, lower_detected_protocol); } if(dst != NULL) { NDPI_ADD_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, upper_detected_protocol); if(lower_detected_protocol != NDPI_PROTOCOL_UNKNOWN) NDPI_ADD_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, lower_detected_protocol); } } u_int16_t ndpi_get_flow_masterprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { return(flow->detected_protocol_stack[1]); } void ndpi_int_change_flow_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t upper_detected_protocol, u_int16_t lower_detected_protocol) { if(!flow) return; flow->detected_protocol_stack[0] = upper_detected_protocol, flow->detected_protocol_stack[1] = lower_detected_protocol; } void ndpi_int_change_packet_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t upper_detected_protocol, u_int16_t lower_detected_protocol) { struct ndpi_packet_struct *packet = &flow->packet; /* NOTE: everything below is identically to change_flow_protocol * except flow->packet If you want to change something here, * don't! Change it for the flow function and apply it here * as well */ if(!packet) return; packet->detected_protocol_stack[0] = upper_detected_protocol, packet->detected_protocol_stack[1] = lower_detected_protocol; } /* generic function for changing the protocol * * what it does is: * 1.update the flow protocol stack with the new protocol * 2.update the packet protocol stack with the new protocol */ void ndpi_int_change_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t upper_detected_protocol, u_int16_t lower_detected_protocol) { if((upper_detected_protocol == NDPI_PROTOCOL_UNKNOWN) && (lower_detected_protocol != NDPI_PROTOCOL_UNKNOWN)) upper_detected_protocol = lower_detected_protocol; if(upper_detected_protocol == lower_detected_protocol) lower_detected_protocol = NDPI_PROTOCOL_UNKNOWN; ndpi_int_change_flow_protocol(ndpi_struct, flow, upper_detected_protocol, lower_detected_protocol); ndpi_int_change_packet_protocol(ndpi_struct, flow, upper_detected_protocol, lower_detected_protocol); } /* change protocol only if guessing is active */ /* void ndpi_guess_change_protocol(struct ndpi_detection_module_struct *ndpi_struct, */ /* struct ndpi_flow_struct *flow) */ /* { */ /* if(flow->guessed_host_protocol_id != 0 && */ /* flow->guessed_protocol_id != 0) { */ /* /\* app proto for flow *\/ */ /* flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; */ /* /\* master proto for flow *\/ */ /* flow->detected_protocol_stack[1] = flow->guessed_protocol_id; */ /* /\* app proto for packet *\/ */ /* flow->packet.detected_protocol_stack[0] = flow->guessed_host_protocol_id; */ /* /\* master proto for packet *\/ */ /* flow->packet.detected_protocol_stack[1] = flow->guessed_protocol_id; */ /* } */ /* } */ /* turns a packet back to unknown */ void ndpi_int_reset_packet_protocol(struct ndpi_packet_struct *packet) { int a; for(a = 0; a < NDPI_PROTOCOL_SIZE; a++) packet->detected_protocol_stack[a] = NDPI_PROTOCOL_UNKNOWN; } void ndpi_int_reset_protocol(struct ndpi_flow_struct *flow) { if(flow) { int a; for(a = 0; a < NDPI_PROTOCOL_SIZE; a++) { flow->detected_protocol_stack[a] = NDPI_PROTOCOL_UNKNOWN; } } } void NDPI_PROTOCOL_IP_clear(ndpi_ip_addr_t * ip) { memset(ip, 0, sizeof(ndpi_ip_addr_t)); } /* NTOP */ int NDPI_PROTOCOL_IP_is_set(const ndpi_ip_addr_t * ip) { return memcmp(ip, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", sizeof(ndpi_ip_addr_t)) != 0; } /* check if the source ip address in packet and ip are equal */ /* NTOP */ int ndpi_packet_src_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip) { #ifdef NDPI_DETECTION_SUPPORT_IPV6 /* IPv6 */ if(packet->iphv6 != NULL) { if(packet->iphv6->ip6_src.u6_addr.u6_addr32[0] == ip->ipv6.u6_addr.u6_addr32[0] && packet->iphv6->ip6_src.u6_addr.u6_addr32[1] == ip->ipv6.u6_addr.u6_addr32[1] && packet->iphv6->ip6_src.u6_addr.u6_addr32[2] == ip->ipv6.u6_addr.u6_addr32[2] && packet->iphv6->ip6_src.u6_addr.u6_addr32[3] == ip->ipv6.u6_addr.u6_addr32[3]) return 1; //else return 0; } #endif /* IPv4 */ if(packet->iph->saddr == ip->ipv4) return 1; return 0; } /* check if the destination ip address in packet and ip are equal */ int ndpi_packet_dst_ip_eql(const struct ndpi_packet_struct *packet, const ndpi_ip_addr_t * ip) { #ifdef NDPI_DETECTION_SUPPORT_IPV6 /* IPv6 */ if(packet->iphv6 != NULL) { if(packet->iphv6->ip6_dst.u6_addr.u6_addr32[0] == ip->ipv6.u6_addr.u6_addr32[0] && packet->iphv6->ip6_dst.u6_addr.u6_addr32[1] == ip->ipv6.u6_addr.u6_addr32[1] && packet->iphv6->ip6_dst.u6_addr.u6_addr32[2] == ip->ipv6.u6_addr.u6_addr32[2] && packet->iphv6->ip6_dst.u6_addr.u6_addr32[3] == ip->ipv6.u6_addr.u6_addr32[3]) return 1; //else return 0; } #endif /* IPv4 */ if(packet->iph->saddr == ip->ipv4) return 1; return 0; } /* get the source ip address from packet and put it into ip */ /* NTOP */ void ndpi_packet_src_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip) { NDPI_PROTOCOL_IP_clear(ip); #ifdef NDPI_DETECTION_SUPPORT_IPV6 /* IPv6 */ if(packet->iphv6 != NULL) { ip->ipv6.u6_addr.u6_addr32[0] = packet->iphv6->ip6_src.u6_addr.u6_addr32[0]; ip->ipv6.u6_addr.u6_addr32[1] = packet->iphv6->ip6_src.u6_addr.u6_addr32[1]; ip->ipv6.u6_addr.u6_addr32[2] = packet->iphv6->ip6_src.u6_addr.u6_addr32[2]; ip->ipv6.u6_addr.u6_addr32[3] = packet->iphv6->ip6_src.u6_addr.u6_addr32[3]; } else #endif /* IPv4 */ ip->ipv4 = packet->iph->saddr; } /* get the destination ip address from packet and put it into ip */ /* NTOP */ void ndpi_packet_dst_ip_get(const struct ndpi_packet_struct *packet, ndpi_ip_addr_t * ip) { NDPI_PROTOCOL_IP_clear(ip); #ifdef NDPI_DETECTION_SUPPORT_IPV6 if(packet->iphv6 != NULL) { ip->ipv6.u6_addr.u6_addr32[0] = packet->iphv6->ip6_dst.u6_addr.u6_addr32[0]; ip->ipv6.u6_addr.u6_addr32[1] = packet->iphv6->ip6_dst.u6_addr.u6_addr32[1]; ip->ipv6.u6_addr.u6_addr32[2] = packet->iphv6->ip6_dst.u6_addr.u6_addr32[2]; ip->ipv6.u6_addr.u6_addr32[3] = packet->iphv6->ip6_dst.u6_addr.u6_addr32[3]; } else #endif ip->ipv4 = packet->iph->daddr; } #ifdef NDPI_ENABLE_DEBUG_MESSAGES /* get the string representation of ip * returns a pointer to a static string * only valid until the next call of this function */ char *ndpi_get_ip_string(struct ndpi_detection_module_struct *ndpi_struct, const ndpi_ip_addr_t * ip) { const u_int8_t *a = (const u_int8_t *) &ip->ipv4; #ifdef NDPI_DETECTION_SUPPORT_IPV6 if(ip->ipv6.u6_addr.u6_addr32[0] != 0 || ip->ipv6.u6_addr.u6_addr32[1] != 0 || ip->ipv6.u6_addr.u6_addr32[2] != 0 || ip->ipv6.u6_addr.u6_addr32[3] != 0) { const u_int16_t *b = ip->ipv6.u6_addr.u6_addr16; snprintf(ndpi_struct->ip_string, 32, "%x:%x:%x:%x:%x:%x:%x:%x", ntohs(b[0]), ntohs(b[1]), ntohs(b[2]), ntohs(b[3]), ntohs(b[4]), ntohs(b[5]), ntohs(b[6]), ntohs(b[7])); return ndpi_struct->ip_string; } #endif snprintf(ndpi_struct->ip_string, 32, "%u.%u.%u.%u", a[0], a[1], a[2], a[3]); return ndpi_struct->ip_string; } /* get the string representation of the source ip address from packet */ char *ndpi_get_packet_src_ip_string(struct ndpi_detection_module_struct *ndpi_struct, const struct ndpi_packet_struct *packet) { ndpi_ip_addr_t ip; ndpi_packet_src_ip_get(packet, &ip); return ndpi_get_ip_string(ndpi_struct, &ip); } /* get the string representation of the destination ip address from packet */ char *ndpi_get_packet_dst_ip_string(struct ndpi_detection_module_struct *ndpi_struct, const struct ndpi_packet_struct *packet) { ndpi_ip_addr_t ip; ndpi_packet_dst_ip_get(packet, &ip); return ndpi_get_ip_string(ndpi_struct, &ip); } #endif /* NDPI_ENABLE_DEBUG_MESSAGES */ /* ****************************************************** */ u_int16_t ntohs_ndpi_bytestream_to_number(const u_int8_t * str, u_int16_t max_chars_to_read, u_int16_t * bytes_read) { u_int16_t val = ndpi_bytestream_to_number(str, max_chars_to_read, bytes_read); return ntohs(val); } /* ****************************************************** */ u_int8_t ndpi_is_proto(ndpi_protocol proto, u_int16_t p) { return(((proto.app_protocol == p) || (proto.master_protocol == p)) ? 1 : 0); } /* ****************************************************** */ u_int16_t ndpi_get_lower_proto(ndpi_protocol proto) { return((proto.master_protocol != NDPI_PROTOCOL_UNKNOWN) ? proto.master_protocol : proto.app_protocol); } /* ****************************************************** */ ndpi_protocol ndpi_guess_undetected_protocol(struct ndpi_detection_module_struct *ndpi_struct, u_int8_t proto, u_int32_t shost /* host byte order */, u_int16_t sport, u_int32_t dhost /* host byte order */, u_int16_t dport) { u_int32_t rc; struct in_addr addr; ndpi_protocol ret = { NDPI_PROTOCOL_UNKNOWN, NDPI_PROTOCOL_UNKNOWN }; u_int8_t user_defined_proto; if((proto == IPPROTO_TCP) || (proto == IPPROTO_UDP)) { rc = ndpi_search_tcp_or_udp_raw(ndpi_struct, NULL, proto, shost, dhost, sport, dport); if(rc != NDPI_PROTOCOL_UNKNOWN) { ret.app_protocol = rc, ret.master_protocol = ndpi_guess_protocol_id(ndpi_struct, proto, sport, dport, &user_defined_proto); if(ret.app_protocol == ret.master_protocol) ret.master_protocol = NDPI_PROTOCOL_UNKNOWN; return(ret); } rc = ndpi_guess_protocol_id(ndpi_struct, proto, sport, dport, &user_defined_proto); if(rc != NDPI_PROTOCOL_UNKNOWN) { ret.app_protocol = rc; if(rc == NDPI_PROTOCOL_SSL) goto check_guessed_skype; else return(ret); } check_guessed_skype: addr.s_addr = htonl(shost); if(ndpi_network_ptree_match(ndpi_struct, &addr) == NDPI_PROTOCOL_SKYPE) { ret.app_protocol = NDPI_PROTOCOL_SKYPE; } else { addr.s_addr = htonl(dhost); if(ndpi_network_ptree_match(ndpi_struct, &addr) == NDPI_PROTOCOL_SKYPE) ret.app_protocol = NDPI_PROTOCOL_SKYPE; } } else ret.app_protocol = ndpi_guess_protocol_id(ndpi_struct, proto, sport, dport, &user_defined_proto); return(ret); } /* ****************************************************** */ char* ndpi_protocol2name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol proto, char *buf, u_int buf_len) { if((proto.master_protocol != NDPI_PROTOCOL_UNKNOWN) && (proto.master_protocol != proto.app_protocol)) { snprintf(buf, buf_len, "%s.%s", ndpi_get_proto_name(ndpi_mod, proto.master_protocol), ndpi_get_proto_name(ndpi_mod, proto.app_protocol)); } else snprintf(buf, buf_len, "%s", ndpi_get_proto_name(ndpi_mod, proto.app_protocol)); return(buf); } /* ****************************************************** */ int ndpi_is_custom_category(ndpi_protocol_category_t category) { switch(category) { case NDPI_PROTOCOL_CATEGORY_CUSTOM_1: case NDPI_PROTOCOL_CATEGORY_CUSTOM_2: case NDPI_PROTOCOL_CATEGORY_CUSTOM_3: case NDPI_PROTOCOL_CATEGORY_CUSTOM_4: case NDPI_PROTOCOL_CATEGORY_CUSTOM_5: return(1); break; default: return(0); break; } } /* ****************************************************** */ void ndpi_category_set_name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_category_t category, char *name) { if(!name) return; switch(category) { case NDPI_PROTOCOL_CATEGORY_CUSTOM_1: snprintf(ndpi_mod->custom_category_labels[0], CUSTOM_CATEGORY_LABEL_LEN, "%s", name); break; case NDPI_PROTOCOL_CATEGORY_CUSTOM_2: snprintf(ndpi_mod->custom_category_labels[1], CUSTOM_CATEGORY_LABEL_LEN, "%s", name); break; case NDPI_PROTOCOL_CATEGORY_CUSTOM_3: snprintf(ndpi_mod->custom_category_labels[2], CUSTOM_CATEGORY_LABEL_LEN, "%s", name); break; case NDPI_PROTOCOL_CATEGORY_CUSTOM_4: snprintf(ndpi_mod->custom_category_labels[3], CUSTOM_CATEGORY_LABEL_LEN, "%s", name); break; case NDPI_PROTOCOL_CATEGORY_CUSTOM_5: snprintf(ndpi_mod->custom_category_labels[4], CUSTOM_CATEGORY_LABEL_LEN, "%s", name); break; default: break; } } /* ****************************************************** */ static const char* categories[] = { "Unspecified", "Media", "VPN", "DataTransfer", "Email", "Download-FileTransfer-FileSharing", "Web", "SocialNetwork", "Game", "Chat", "VoIP", "Database", "RemoteAccess", "Cloud", "Network", "Collaborative", "RPC", "NetworkTool", "System", "SoftwareUpdate", "", "", "", "", "" }; const char* ndpi_category_get_name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_category_t category) { if(!ndpi_mod) return(NULL); if(category < NDPI_PROTOCOL_CATEGORY_CUSTOM_1) return(categories[category]); else { switch(category) { case NDPI_PROTOCOL_CATEGORY_CUSTOM_1: return(ndpi_mod->custom_category_labels[0]); case NDPI_PROTOCOL_CATEGORY_CUSTOM_2: return(ndpi_mod->custom_category_labels[1]); case NDPI_PROTOCOL_CATEGORY_CUSTOM_3: return(ndpi_mod->custom_category_labels[2]); case NDPI_PROTOCOL_CATEGORY_CUSTOM_4: return(ndpi_mod->custom_category_labels[3]); case NDPI_PROTOCOL_CATEGORY_CUSTOM_5: return(ndpi_mod->custom_category_labels[4]); case NDPI_PROTOCOL_NUM_CATEGORIES: return("Code should not use this internal constant"); default: return("Unspecified"); } } } /* ****************************************************** */ ndpi_protocol_category_t ndpi_get_proto_category(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol proto) { /* simple rule: sub protocol first, master after */ if ((proto.master_protocol == NDPI_PROTOCOL_UNKNOWN) || (ndpi_mod->proto_defaults[proto.app_protocol].protoCategory != NDPI_PROTOCOL_CATEGORY_UNSPECIFIED)) return ndpi_mod->proto_defaults[proto.app_protocol].protoCategory; else return ndpi_mod->proto_defaults[proto.master_protocol].protoCategory; } /* ****************************************************** */ char* ndpi_get_proto_name(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t proto_id) { if((proto_id >= ndpi_mod->ndpi_num_supported_protocols) || ((proto_id < (NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS)) && (ndpi_mod->proto_defaults[proto_id].protoName == NULL))) proto_id = NDPI_PROTOCOL_UNKNOWN; return(ndpi_mod->proto_defaults[proto_id].protoName); } /* ****************************************************** */ ndpi_protocol_breed_t ndpi_get_proto_breed(struct ndpi_detection_module_struct *ndpi_mod, u_int16_t proto_id) { if((proto_id >= ndpi_mod->ndpi_num_supported_protocols) || ((proto_id < (NDPI_MAX_SUPPORTED_PROTOCOLS+NDPI_MAX_NUM_CUSTOM_PROTOCOLS)) && (ndpi_mod->proto_defaults[proto_id].protoName == NULL))) proto_id = NDPI_PROTOCOL_UNKNOWN; return(ndpi_mod->proto_defaults[proto_id].protoBreed); } /* ****************************************************** */ char* ndpi_get_proto_breed_name(struct ndpi_detection_module_struct *ndpi_mod, ndpi_protocol_breed_t breed_id) { switch(breed_id) { case NDPI_PROTOCOL_SAFE: return("Safe"); break; case NDPI_PROTOCOL_ACCEPTABLE: return("Acceptable"); break; case NDPI_PROTOCOL_FUN: return("Fun"); break; case NDPI_PROTOCOL_UNSAFE: return("Unsafe"); break; case NDPI_PROTOCOL_POTENTIALLY_DANGEROUS: return("Dangerous"); break; case NDPI_PROTOCOL_UNRATED: default: return("Unrated"); break; } } /* ****************************************************** */ int ndpi_get_protocol_id(struct ndpi_detection_module_struct *ndpi_mod, char *proto) { int i; for(i=0; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++) if(strcasecmp(proto, ndpi_mod->proto_defaults[i].protoName) == 0) return(i); return(-1); } /* ****************************************************** */ void ndpi_dump_protocols(struct ndpi_detection_module_struct *ndpi_mod) { int i; for(i=0; i<(int)ndpi_mod->ndpi_num_supported_protocols; i++) printf("[%3d] %s\n", i, ndpi_mod->proto_defaults[i].protoName); } /* ****************************************************** */ /* * Find the first occurrence of find in s, where the search is limited to the * first slen characters of s. */ char* ndpi_strnstr(const char *s, const char *find, size_t slen) { char c, sc; size_t len; if((c = *find++) != '\0') { len = strlen(find); do { do { if(slen-- < 1 || (sc = *s++) == '\0') return (NULL); } while (sc != c); if(len > slen) return (NULL); } while (strncmp(s, find, len) != 0); s--; } return ((char *)s); } /* ****************************************************** */ /* * Same as ndpi_strnstr but case-insensitive */ char* ndpi_strncasestr(const char *s, const char *find, size_t slen) { char c, sc; size_t len; if((c = *find++) != '\0') { len = strlen(find); do { do { if(slen-- < 1 || (sc = *s++) == '\0') return (NULL); } while (sc != c); if(len > slen) return (NULL); } while (strncasecmp(s, find, len) != 0); s--; } return ((char *)s); } /* ****************************************************** */ int ndpi_match_prefix(const u_int8_t *payload, size_t payload_len, const char *str, size_t str_len) { int rc = str_len <= payload_len ? memcmp(payload, str, str_len) == 0 : 0; return rc; } /* ****************************************************** */ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, char *string_to_match, u_int string_to_match_len, u_int8_t is_host_match) { int matching_protocol_id = NDPI_PROTOCOL_UNKNOWN; AC_TEXT_t ac_input_text; ndpi_automa *automa = is_host_match ? &ndpi_struct->host_automa : &ndpi_struct->content_automa; if((automa->ac_automa == NULL) || (string_to_match_len == 0)) return(NDPI_PROTOCOL_UNKNOWN); if(!automa->ac_automa_finalized) { ac_automata_finalize((AC_AUTOMATA_t*)automa->ac_automa); automa->ac_automa_finalized = 1; } ac_input_text.astring = string_to_match, ac_input_text.length = string_to_match_len; ac_automata_search(((AC_AUTOMATA_t*)automa->ac_automa), &ac_input_text, (void*)&matching_protocol_id); ac_automata_reset(((AC_AUTOMATA_t*)automa->ac_automa)); return(matching_protocol_id); } /* ****************************************************** */ static int ndpi_automa_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *string_to_match, u_int string_to_match_len, u_int16_t master_protocol_id, u_int8_t is_host_match) { int matching_protocol_id = ndpi_match_string_subprotocol(ndpi_struct, string_to_match, string_to_match_len, is_host_match); struct ndpi_packet_struct *packet = &flow->packet; #ifdef DEBUG { char m[256]; int len = ndpi_min(sizeof(m), string_to_match_len); strncpy(m, string_to_match, len); m[len] = '\0'; printf("[NDPI] ndpi_match_host_subprotocol(%s): %s\n", m, ndpi_struct->proto_defaults[matching_protocol_id].protoName); } #endif if(matching_protocol_id != NDPI_PROTOCOL_UNKNOWN) { /* Move the protocol on slot 0 down one position */ packet->detected_protocol_stack[1] = master_protocol_id, packet->detected_protocol_stack[0] = matching_protocol_id; flow->detected_protocol_stack[0] = packet->detected_protocol_stack[0], flow->detected_protocol_stack[1] = packet->detected_protocol_stack[1]; return(packet->detected_protocol_stack[0]); } #ifdef DEBUG string_to_match[string_to_match_len] = '\0'; printf("[NTOP] Unable to find a match for '%s'\n", string_to_match); #endif return(NDPI_PROTOCOL_UNKNOWN); } /* ****************************************************** */ int ndpi_match_host_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *string_to_match, u_int string_to_match_len, u_int16_t master_protocol_id) { return(ndpi_automa_match_string_subprotocol(ndpi_struct, flow, string_to_match, string_to_match_len, master_protocol_id, 1)); } /* ****************************************************** */ int ndpi_match_content_subprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *string_to_match, u_int string_to_match_len, u_int16_t master_protocol_id) { return(ndpi_automa_match_string_subprotocol(ndpi_struct, flow, string_to_match, string_to_match_len, master_protocol_id, 0)); } /* ****************************************************** */ int ndpi_match_bigram(struct ndpi_detection_module_struct *ndpi_struct, ndpi_automa *automa, char *bigram_to_match) { AC_TEXT_t ac_input_text; int ret = 0; if((automa->ac_automa == NULL) || (bigram_to_match == NULL)) return(ret); if(!automa->ac_automa_finalized) { ac_automata_finalize((AC_AUTOMATA_t*)automa->ac_automa); automa->ac_automa_finalized = 1; } ac_input_text.astring = bigram_to_match, ac_input_text.length = 2; ac_automata_search(((AC_AUTOMATA_t*)automa->ac_automa), &ac_input_text, (void*)&ret); ac_automata_reset(((AC_AUTOMATA_t*)automa->ac_automa)); return(ret); } /* ****************************************************** */ void ndpi_free_flow(struct ndpi_flow_struct *flow) { if(flow) { if(flow->http.url) ndpi_free(flow->http.url); if(flow->http.content_type) ndpi_free(flow->http.content_type); ndpi_free(flow); } } /* ****************************************************** */ char* ndpi_revision() { return(NDPI_GIT_RELEASE); } /* ****************************************************** */ #ifdef WIN32 /* http://git.postgresql.org/gitweb/?p=postgresql.git;a=blob;f=src/port/gettimeofday.c;h=75a91993b74414c0a1c13a2a09ce739cb8aa8a08;hb=HEAD */ int gettimeofday(struct timeval * tp, struct timezone * tzp) { /* FILETIME of Jan 1 1970 00:00:00. */ const unsigned __int64 epoch = (__int64)(116444736000000000); FILETIME file_time; SYSTEMTIME system_time; ULARGE_INTEGER ularge; GetSystemTime(&system_time); SystemTimeToFileTime(&system_time, &file_time); ularge.LowPart = file_time.dwLowDateTime; ularge.HighPart = file_time.dwHighDateTime; tp->tv_sec = (long) ((ularge.QuadPart - epoch) / 10000000L); tp->tv_usec = (long) (system_time.wMilliseconds * 1000); return 0; } #endif int NDPI_BITMASK_COMPARE(NDPI_PROTOCOL_BITMASK a, NDPI_PROTOCOL_BITMASK b) { int i; for(i=0; i. * * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_AFP struct afpHeader { u_int8_t flags, command; u_int16_t requestId; u_int32_t dataOffset, length, reserved; }; static void ndpi_int_afp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AFP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_afp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->payload_packet_len >= sizeof(struct afpHeader)) { struct afpHeader *h = (struct afpHeader*)packet->payload; if(packet->payload_packet_len > 128) { /* When we transfer a large data chunk, unless we have observed the initial connection, we need to discard these packets as they are not an indication that this flow is not AFP */ return; } /* * this will detect the OpenSession command of the Data Stream Interface (DSI) protocol * which is exclusively used by the Apple Filing Protocol (AFP) on TCP/IP networks */ if (packet->payload_packet_len >= 22 && get_u_int16_t(packet->payload, 0) == htons(0x0004) && get_u_int16_t(packet->payload, 2) == htons(0x0001) && get_u_int32_t(packet->payload, 4) == 0 && get_u_int32_t(packet->payload, 8) == htonl(packet->payload_packet_len - 16) && get_u_int32_t(packet->payload, 12) == 0 && get_u_int16_t(packet->payload, 16) == htons(0x0104)) { NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP: DSI OpenSession detected.\n"); ndpi_int_afp_add_connection(ndpi_struct, flow); return; } if((h->flags <= 1) && ((h->command >= 1) && (h->command <= 8)) && (h->reserved == 0) && (packet->payload_packet_len >= (sizeof(struct afpHeader)+ntohl(h->length)))) { NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP: DSI detected.\n"); ndpi_int_afp_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_AFP, ndpi_struct, NDPI_LOG_DEBUG, "AFP excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_AFP); } void init_afp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("AFP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_AFP, ndpi_search_afp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/aimini.c000066400000000000000000000321221321103654100171360ustar00rootroot00000000000000/* * aimini.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_AIMINI static void ndpi_int_aimini_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AIMINI, NDPI_PROTOCOL_UNKNOWN); } static u_int8_t is_special_aimini_host(struct ndpi_int_one_line_struct host_line) { if (host_line.ptr != NULL && host_line.len >= NDPI_STATICSTRING_LEN("X.X.X.X.aimini.net")) { if ((get_u_int32_t(host_line.ptr, 0) & htonl(0x00ff00ff)) == htonl(0x002e002e) && (get_u_int32_t(host_line.ptr, 4) & htonl(0x00ff00ff)) == htonl(0x002e002e) && memcmp(&host_line.ptr[8], "aimini.net", NDPI_STATICSTRING_LEN("aimini.net")) == 0) { return 1; } } return 0; } void ndpi_search_aimini(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "search aimini.\n"); if (packet->udp != NULL) { if (flow->l4.udp.aimini_stage == 0) { if (packet->payload_packet_len == 64 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010b) { flow->l4.udp.aimini_stage = 1; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 1.\n"); return; } if (packet->payload_packet_len == 136 && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165)) { flow->l4.udp.aimini_stage = 4; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 4.\n"); return; } if (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101) { flow->l4.udp.aimini_stage = 7; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 7.\n"); return; } if (packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) { flow->l4.udp.aimini_stage = 10; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 10.\n"); return; } if (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) { flow->l4.udp.aimini_stage = 13; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 13.\n"); return; } if (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) { flow->l4.udp.aimini_stage = 16; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 16.\n"); return; } } /* first packet chronology: (len, value): (64, 0x010b), (>100, 0x0115), (16, 0x010c || 64, 0x010b || 88, 0x0115), * (16, 0x010c || 64, 0x010b || >100, 0x0115) */ if (flow->l4.udp.aimini_stage == 1 && packet->payload_packet_len > 100 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0115) { flow->l4.udp.aimini_stage = 2; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 2.\n"); return; } if (flow->l4.udp.aimini_stage == 2 && ((packet->payload_packet_len == 16 && get_u_int16_t(packet->payload, 0) == htons(0x010c)) || (packet->payload_packet_len == 64 && get_u_int16_t(packet->payload, 0) == htons(0x010b)) || (packet->payload_packet_len == 88 && get_u_int16_t(packet->payload, 0) == ntohs(0x0115)))) { flow->l4.udp.aimini_stage = 3; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 3.\n"); return; } if (flow->l4.udp.aimini_stage == 3 && ((packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) || (packet->payload_packet_len == 64 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010b) || (packet->payload_packet_len > 100 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0115))) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "found aimini (64, 0x010b), (>300, 0x0115), " "(16, 0x010c || 64, 0x010b), (16, 0x010c || 64, 0x010b || >100, 0x0115).\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } /* second packet chronology: (len, value): (136, 0x01c9), (136, 0x01c9),(136, 0x01c9),(136, 0x01c9 || 32, 0x01ca) */ if (flow->l4.udp.aimini_stage == 4 && packet->payload_packet_len == 136 && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165)) { flow->l4.udp.aimini_stage = 5; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 5.\n"); return; } if (flow->l4.udp.aimini_stage == 5 && (packet->payload_packet_len == 136 && (ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9 || ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165))) { flow->l4.udp.aimini_stage = 6; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 6.\n"); return; } if (flow->l4.udp.aimini_stage == 6 && ((packet->payload_packet_len == 136 && ((ntohs(get_u_int16_t(packet->payload, 0)) == 0x0165) || ntohs(get_u_int16_t(packet->payload, 0)) == 0x01c9)) || (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "found aimini (136, 0x01c9), (136, 0x01c9)," "(136, 0x01c9),(136, 0x01c9 || 32, 0x01ca).\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } /* third packet chronology: (len, value): (88, 0x0101), (88, 0x0101),(88, 0x0101),(88, 0x0101) */ if (flow->l4.udp.aimini_stage == 7 && packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101) { flow->l4.udp.aimini_stage = 8; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 8.\n"); return; } if (flow->l4.udp.aimini_stage == 8 && (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101)) { flow->l4.udp.aimini_stage = 9; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 9.\n"); return; } if (flow->l4.udp.aimini_stage == 9 && (packet->payload_packet_len == 88 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0101)) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "found aimini (88, 0x0101), (88, 0x0101)," "(88, 0x0101),(88, 0x0101).\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } /* fourth packet chronology: (len, value): (104, 0x0102), (104, 0x0102), (104, 0x0102), (104, 0x0102) */ if (flow->l4.udp.aimini_stage == 10 && packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) { flow->l4.udp.aimini_stage = 11; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 11.\n"); return; } if (flow->l4.udp.aimini_stage == 11 && (packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102)) { flow->l4.udp.aimini_stage = 12; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 12.\n"); return; } if (flow->l4.udp.aimini_stage == 12 && ((packet->payload_packet_len == 104 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0102) || (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "found aimini (104, 0x0102), (104, 0x0102), " "(104, 0x0102), (104, 0x0102).\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } /* fifth packet chronology (len, value): (32,0x01ca), (32,0x01ca), (32,0x01ca), ((136, 0x0166) || (32,0x01ca)) */ if (flow->l4.udp.aimini_stage == 13 && packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) { flow->l4.udp.aimini_stage = 14; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 14.\n"); return; } if (flow->l4.udp.aimini_stage == 14 && ((packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca) || (packet->payload_packet_len == 136 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0166))) { flow->l4.udp.aimini_stage = 15; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 15.\n"); return; } if (flow->l4.udp.aimini_stage == 15 && ((packet->payload_packet_len == 136 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0166) || (packet->payload_packet_len == 32 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x01ca))) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "found aimini (32,0x01ca), (32,0x01ca), (32,0x01ca), ((136, 0x0166)||(32,0x01ca)).\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } /* sixth packet chronology (len, value): (16, 0x010c), (16, 0x010c), (16, 0x010c), (16, 0x010c) */ if (flow->l4.udp.aimini_stage == 16 && packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c) { flow->l4.udp.aimini_stage = 17; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 17.\n"); return; } if (flow->l4.udp.aimini_stage == 17 && (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c)) { flow->l4.udp.aimini_stage = 18; NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "stage = 18.\n"); return; } if (flow->l4.udp.aimini_stage == 18 && (packet->payload_packet_len == 16 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x010c)) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "found aimini (16, 0x010c), (16, 0x010c), (16, 0x010c), (16, 0x010c).\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } } else if (packet->tcp != NULL) { if ((packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /player/") && (memcmp(packet->payload, "GET /player/", NDPI_STATICSTRING_LEN("GET /player/")) == 0)) || (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /play/?fid=") && (memcmp(packet->payload, "GET /play/?fid=", NDPI_STATICSTRING_LEN("GET /play/?fid=")) == 0))) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "HTTP packet detected.\n"); ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->host_line.ptr != NULL && packet->host_line.len > 11 && (memcmp(&packet->host_line.ptr[packet->host_line.len - 11], ".aimini.net", 11) == 0)) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "AIMINI HTTP traffic detected.\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } } if (packet->payload_packet_len > 100) { if (memcmp(packet->payload, "GET /", NDPI_STATICSTRING_LEN("GET /")) == 0) { if (memcmp(&packet->payload[NDPI_STATICSTRING_LEN("GET /")], "play/", NDPI_STATICSTRING_LEN("play/")) == 0 || memcmp(&packet->payload[NDPI_STATICSTRING_LEN("GET /")], "download/", NDPI_STATICSTRING_LEN("download/")) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (is_special_aimini_host(packet->host_line) == 1) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "AIMINI HTTP traffic detected.\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } } } else if (memcmp(packet->payload, "POST /", NDPI_STATICSTRING_LEN("POST /")) == 0) { if (memcmp(&packet->payload[NDPI_STATICSTRING_LEN("POST /")], "upload/", NDPI_STATICSTRING_LEN("upload/")) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (is_special_aimini_host(packet->host_line) == 1) { NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "AIMINI HTTP traffic detected.\n"); ndpi_int_aimini_add_connection(ndpi_struct, flow); return; } } } } } NDPI_LOG(NDPI_PROTOCOL_AIMINI, ndpi_struct, NDPI_LOG_DEBUG, "exclude aimini.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_AIMINI); } void init_aimini_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Aimini", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_AIMINI, ndpi_search_aimini, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/amqp.c000066400000000000000000000050551321103654100166330ustar00rootroot00000000000000/* * amqp.c * * Copyright (C) 2011-17 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_AMQP PACK_ON struct amqp_header { u_int8_t ptype; u_int16_t channel; u_int32_t length; u_int16_t class_id, method; } PACK_OFF; static void ndpi_int_amqp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AMQP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_amqp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_AMQP, ndpi_struct, NDPI_LOG_DEBUG, "search amqp. \n"); if (packet->tcp != NULL) { if(packet->payload_packet_len > sizeof(struct amqp_header)) { struct amqp_header *h = (struct amqp_header*)packet->payload; if(h->ptype <= 3) { u_int32_t length = htonl(h->length); if(((length+8) >= packet->payload_packet_len) && (length < 32768) /* Upper bound */) { u_int16_t class_id = htons(h->class_id); if((class_id >= 10) /* Connection */ && (class_id <= 110) /* Tunnel */) { u_int16_t method = htons(h->method); if(method <= 120 /* Method basic NACK */) { NDPI_LOG(NDPI_PROTOCOL_AMQP, ndpi_struct, NDPI_LOG_DEBUG, "found amqp over tcp. \n"); ndpi_int_amqp_add_connection(ndpi_struct, flow); return; } } } } } } } void init_amqp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("AMQP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_AMQP, ndpi_search_amqp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/applejuice.c000066400000000000000000000050321321103654100200110ustar00rootroot00000000000000/* * applejuice.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_APPLEJUICE static void ndpi_int_applejuice_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_APPLEJUICE, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_applejuice_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_APPLEJUICE, ndpi_struct, NDPI_LOG_DEBUG, "search applejuice.\n"); if ((packet->payload_packet_len > 7) && (packet->payload[6] == 0x0d) && (packet->payload[7] == 0x0a) && (memcmp(packet->payload, "ajprot", 6) == 0)) { NDPI_LOG(NDPI_PROTOCOL_APPLEJUICE, ndpi_struct, NDPI_LOG_DEBUG, "detected applejuice.\n"); ndpi_int_applejuice_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_APPLEJUICE, ndpi_struct, NDPI_LOG_DEBUG, "exclude applejuice.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_APPLEJUICE); } void init_applejuice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("AppleJuice", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_APPLEJUICE, ndpi_search_applejuice_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/armagetron.c000066400000000000000000000106431321103654100200330ustar00rootroot00000000000000/* * armagetron.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_ARMAGETRON static void ndpi_int_armagetron_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ARMAGETRON, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_armagetron_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_ARMAGETRON, ndpi_struct, NDPI_LOG_DEBUG, "search armagetron.\n"); if (packet->payload_packet_len > 10) { /* login request */ if (get_u_int32_t(packet->payload, 0) == htonl(0x000b0000)) { const u_int16_t dataLength = ntohs(get_u_int16_t(packet->payload, 4)); if (dataLength == 0 || dataLength * 2 + 8 != packet->payload_packet_len) goto exclude; if (get_u_int16_t(packet->payload, 6) == htons(0x0008) && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { NDPI_LOG(NDPI_PROTOCOL_ARMAGETRON, ndpi_struct, NDPI_LOG_DEBUG, "detected armagetron.\n"); ndpi_int_armagetron_add_connection(ndpi_struct, flow); return; } } /* sync_msg */ if (packet->payload_packet_len == 16 && get_u_int16_t(packet->payload, 0) == htons(0x001c) && get_u_int16_t(packet->payload, 2) != 0) { const u_int16_t dataLength = ntohs(get_u_int16_t(packet->payload, 4)); if (dataLength != 4) goto exclude; if (get_u_int32_t(packet->payload, 6) == htonl(0x00000500) && get_u_int32_t(packet->payload, 6 + 4) == htonl(0x00010000) && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { NDPI_LOG(NDPI_PROTOCOL_ARMAGETRON, ndpi_struct, NDPI_LOG_DEBUG, "detected armagetron.\n"); ndpi_int_armagetron_add_connection(ndpi_struct, flow); return; } } /* net_sync combination */ if (packet->payload_packet_len > 50 && get_u_int16_t(packet->payload, 0) == htons(0x0018) && get_u_int16_t(packet->payload, 2) != 0) { u_int16_t val; const u_int16_t dataLength = ntohs(get_u_int16_t(packet->payload, 4)); if (dataLength == 0 || dataLength * 2 + 8 > packet->payload_packet_len) goto exclude; val = get_u_int16_t(packet->payload, 6 + 2); if (val == get_u_int16_t(packet->payload, 6 + 6)) { val = ntohs(get_u_int16_t(packet->payload, 6 + 8)); if ((6 + 10 + val + 4) < packet->payload_packet_len && (get_u_int32_t(packet->payload, 6 + 10 + val) == htonl(0x00010000) || get_u_int32_t(packet->payload, 6 + 10 + val) == htonl(0x00000001)) && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == 0) { NDPI_LOG(NDPI_PROTOCOL_ARMAGETRON, ndpi_struct, NDPI_LOG_DEBUG, "detected armagetron.\n"); ndpi_int_armagetron_add_connection(ndpi_struct, flow); return; } } } } exclude: NDPI_LOG(NDPI_PROTOCOL_ARMAGETRON, ndpi_struct, NDPI_LOG_DEBUG, "exclude armagetron.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_ARMAGETRON); } void init_armagetron_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Armagetron", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_ARMAGETRON, ndpi_search_armagetron_udp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/attic/000077500000000000000000000000001321103654100166305ustar00rootroot00000000000000nDPI-2.2/src/lib/protocols/attic/flash.c000066400000000000000000000073531321103654100201010ustar00rootroot00000000000000/* * flash.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_FLASH static void ndpi_int_flash_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FLASH); } void ndpi_search_flash(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (flow->l4.tcp.flash_stage == 0 && packet->payload_packet_len > 0 && (packet->payload[0] == 0x03 || packet->payload[0] == 0x06)) { flow->l4.tcp.flash_bytes = packet->payload_packet_len; if (packet->tcp->psh == 0) { NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH pass 1: \n"); flow->l4.tcp.flash_stage = packet->packet_direction + 1; NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH pass 1: flash_stage: %u, flash_bytes: %u\n", flow->l4.tcp.flash_stage, flow->l4.tcp.flash_bytes); return; } else if (packet->tcp->psh != 0 && flow->l4.tcp.flash_bytes == 1537) { NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH hit: flash_stage: %u, flash_bytes: %u\n", flow->l4.tcp.flash_stage, flow->l4.tcp.flash_bytes); flow->l4.tcp.flash_stage = 3; ndpi_int_flash_add_connection(ndpi_struct, flow); return; } } else if (flow->l4.tcp.flash_stage == 1 + packet->packet_direction) { flow->l4.tcp.flash_bytes += packet->payload_packet_len; if (packet->tcp->psh != 0 && flow->l4.tcp.flash_bytes == 1537) { NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH hit: flash_stage: %u, flash_bytes: %u\n", flow->l4.tcp.flash_stage, flow->l4.tcp.flash_bytes); flow->l4.tcp.flash_stage = 3; ndpi_int_flash_add_connection(ndpi_struct, flow); return; } else if (packet->tcp->psh == 0 && flow->l4.tcp.flash_bytes < 1537) { NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH pass 2: flash_stage: %u, flash_bytes: %u\n", flow->l4.tcp.flash_stage, flow->l4.tcp.flash_bytes); return; } } NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH might be excluded: flash_stage: %u, flash_bytes: %u, packet_direction: %u\n", flow->l4.tcp.flash_stage, flow->l4.tcp.flash_bytes, packet->packet_direction); #ifdef NDPI_PROTOCOL_HTTP if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) { #endif /* NDPI_PROTOCOL_HTTP */ NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH: exclude\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FLASH); #ifdef NDPI_PROTOCOL_HTTP } else { NDPI_LOG(NDPI_PROTOCOL_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "FLASH avoid early exclude from http\n"); } #endif /* NDPI_PROTOCOL_HTTP */ } #endif nDPI-2.2/src/lib/protocols/attic/ftp.c000066400000000000000000000402131321103654100175650ustar00rootroot00000000000000/* * ftp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #include "ndpi_utils.h" #ifdef NDPI_PROTOCOL_FTP static void ndpi_int_ftp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FTP); } /** * checks for possible FTP command * not all valid commands are tested, it just need to be 3 or 4 characters followed by a space if the * packet is longer * * this functions is not used to accept, just to not reject */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_int_check_possible_ftp_command(const struct ndpi_packet_struct *packet) { if (packet->payload_packet_len < 3) return 0; if ((packet->payload[0] < 'a' || packet->payload[0] > 'z') && (packet->payload[0] < 'A' || packet->payload[0] > 'Z')) return 0; if ((packet->payload[1] < 'a' || packet->payload[1] > 'z') && (packet->payload[1] < 'A' || packet->payload[1] > 'Z')) return 0; if ((packet->payload[2] < 'a' || packet->payload[2] > 'z') && (packet->payload[2] < 'A' || packet->payload[2] > 'Z')) return 0; if (packet->payload_packet_len > 3) { if ((packet->payload[3] < 'a' || packet->payload[3] > 'z') && (packet->payload[3] < 'A' || packet->payload[3] > 'Z') && packet->payload[3] != ' ') return 0; if (packet->payload_packet_len > 4) { if (packet->payload[3] != ' ' && packet->payload[4] != ' ') return 0; } } return 1; } /** * ftp replies are are 3-digit number followed by space or hyphen */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_int_check_possible_ftp_reply(const struct ndpi_packet_struct *packet) { if (packet->payload_packet_len < 5) return 0; if (packet->payload[3] != ' ' && packet->payload[3] != '-') return 0; if (packet->payload[0] < '0' || packet->payload[0] > '9') return 0; if (packet->payload[1] < '0' || packet->payload[1] > '9') return 0; if (packet->payload[2] < '0' || packet->payload[2] > '9') return 0; return 1; } /** * check for continuation replies * there is no real indication whether it is a continuation message, we just * require that there are at least 5 ascii characters */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_int_check_possible_ftp_continuation_reply(const struct ndpi_packet_struct *packet) { u_int16_t i; if (packet->payload_packet_len < 5) return 0; for (i = 0; i < 5; i++) { if (packet->payload[i] < ' ' || packet->payload[i] > 127) return 0; } return 1; } /* * these are the commands we tracking and expecting to see */ enum { FTP_USER_CMD = 1 << 0, FTP_FEAT_CMD = 1 << 1, FTP_COMMANDS = ((1 << 2) - 1), FTP_220_CODE = 1 << 2, FTP_331_CODE = 1 << 3, FTP_211_CODE = 1 << 4, FTP_CODES = ((1 << 5) - 1 - FTP_COMMANDS) }; /* return 0 if nothing has been detected return 1 if a pop packet */ static u_int8_t search_ftp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int8_t current_ftp_code = 0; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; /* initiate client direction flag */ if (flow->packet_counter == 1) { if (flow->l4.tcp.seen_syn) { flow->l4.tcp.ftp_client_direction = flow->setup_packet_direction; } else { /* no syn flag seen so guess */ if (packet->payload_packet_len > 0) { if (packet->payload[0] >= '0' && packet->payload[0] <= '9') { /* maybe server side */ flow->l4.tcp.ftp_client_direction = 1 - packet->packet_direction; } else { flow->l4.tcp.ftp_client_direction = packet->packet_direction; } } } } if (packet->packet_direction == flow->l4.tcp.ftp_client_direction) { if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("USER ") && (memcmp(packet->payload, "USER ", NDPI_STATICSTRING_LEN("USER ")) == 0 || memcmp(packet->payload, "user ", NDPI_STATICSTRING_LEN("user ")) == 0)) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP: found USER command\n"); flow->l4.tcp.ftp_codes_seen |= FTP_USER_CMD; current_ftp_code = FTP_USER_CMD; } else if (packet->payload_packet_len >= NDPI_STATICSTRING_LEN("FEAT") && (memcmp(packet->payload, "FEAT", NDPI_STATICSTRING_LEN("FEAT")) == 0 || memcmp(packet->payload, "feat", NDPI_STATICSTRING_LEN("feat")) == 0)) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP: found FEAT command\n"); flow->l4.tcp.ftp_codes_seen |= FTP_FEAT_CMD; current_ftp_code = FTP_FEAT_CMD; } else if (!ndpi_int_check_possible_ftp_command(packet)) { return 0; } } else { if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("220 ") && (memcmp(packet->payload, "220 ", NDPI_STATICSTRING_LEN("220 ")) == 0 || memcmp(packet->payload, "220-", NDPI_STATICSTRING_LEN("220-")) == 0)) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP: found 220 reply code\n"); flow->l4.tcp.ftp_codes_seen |= FTP_220_CODE; current_ftp_code = FTP_220_CODE; } else if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("331 ") && (memcmp(packet->payload, "331 ", NDPI_STATICSTRING_LEN("331 ")) == 0 || memcmp(packet->payload, "331-", NDPI_STATICSTRING_LEN("331-")) == 0)) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP: found 331 reply code\n"); flow->l4.tcp.ftp_codes_seen |= FTP_331_CODE; current_ftp_code = FTP_331_CODE; } else if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("211 ") && (memcmp(packet->payload, "211 ", NDPI_STATICSTRING_LEN("211 ")) == 0 || memcmp(packet->payload, "211-", NDPI_STATICSTRING_LEN("211-")) == 0)) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP: found 211reply code\n"); flow->l4.tcp.ftp_codes_seen |= FTP_211_CODE; current_ftp_code = FTP_211_CODE; } else if (!ndpi_int_check_possible_ftp_reply(packet)) { if ((flow->l4.tcp.ftp_codes_seen & FTP_CODES) == 0 || (!ndpi_int_check_possible_ftp_continuation_reply(packet))) { return 0; } } } if ((flow->l4.tcp.ftp_codes_seen & FTP_COMMANDS) != 0 && (flow->l4.tcp.ftp_codes_seen & FTP_CODES) != 0) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP detected\n"); ndpi_int_ftp_add_connection(ndpi_struct, flow); return 1; } /* if no valid code has been seen for the first packets reject */ if (flow->l4.tcp.ftp_codes_seen == 0 && flow->packet_counter > 3) return 0; /* otherwise wait more packets, wait more for traffic on known ftp port */ if ((packet->packet_direction == flow->setup_packet_direction && packet->tcp && packet->tcp->dest == htons(21)) || (packet->packet_direction != flow->setup_packet_direction && packet->tcp && packet->tcp->source == htons(21))) { /* flow to known ftp port */ /* wait much longer if this was a 220 code, initial messages might be long */ if (current_ftp_code == FTP_220_CODE) { if (flow->packet_counter > 40) return 0; } else { if (flow->packet_counter > 20) return 0; } } else { /* wait much longer if this was a 220 code, initial messages might be long */ if (current_ftp_code == FTP_220_CODE) { if (flow->packet_counter > 20) return 0; } else { if (flow->packet_counter > 10) return 0; } } return 2; } static void search_passive_ftp_mode(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *dst = flow->dst; struct ndpi_id_struct *src = flow->src; u_int16_t plen; u_int8_t i; u_int32_t ftp_ip; // TODO check if normal passive mode also needs adaption for ipv6 if (packet->payload_packet_len > 3 && ndpi_mem_cmp(packet->payload, "227 ", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP passive mode initial string\n"); plen = 4; //=4 for "227 " while (1) { if (plen >= packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "plen >= packet->payload_packet_len, return\n"); return; } if (packet->payload[plen] == '(') { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "found (. break.\n"); break; } /* if (!isalnum(packet->payload[plen])) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "no alpha numeric symbol --> break.\n"); return; }*/ plen++; } plen++; if (plen >= packet->payload_packet_len) return; ftp_ip = 0; for (i = 0; i < 4; i++) { u_int16_t oldplen = plen; ftp_ip = (ftp_ip << 8) + ndpi_bytestream_to_number(&packet->payload[plen], packet->payload_packet_len - plen, &plen); if (oldplen == plen || plen >= packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP passive mode %u value parse failed\n", i); return; } if (packet->payload[plen] != ',') { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP passive mode %u value parse failed, char ',' is missing\n", i); return; } plen++; NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP passive mode %u value parsed, ip is now: %u\n", i, ftp_ip); } if (dst != NULL) { dst->ftp_ip.ipv4 = htonl(ftp_ip); dst->ftp_timer = packet->tick_timestamp; dst->ftp_timer_set = 1; NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "saved ftp_ip, ftp_timer, ftp_timer_set to dst"); NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP PASSIVE MODE FOUND: use Server %s\n", ndpi_get_ip_string(ndpi_struct, &dst->ftp_ip)); } if (src != NULL) { src->ftp_ip.ipv4 = packet->iph->daddr; src->ftp_timer = packet->tick_timestamp; src->ftp_timer_set = 1; NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "saved ftp_ip, ftp_timer, ftp_timer_set to src"); NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP PASSIVE MODE FOUND: use Server %s\n", ndpi_get_ip_string(ndpi_struct, &src->ftp_ip)); } return; } if (packet->payload_packet_len > 34 && ndpi_mem_cmp(packet->payload, "229 Entering Extended Passive Mode", 34) == 0) { if (dst != NULL) { ndpi_packet_src_ip_get(packet, &dst->ftp_ip); dst->ftp_timer = packet->tick_timestamp; dst->ftp_timer_set = 1; NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "saved ftp_ip, ftp_timer, ftp_timer_set to dst"); NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP Extended PASSIVE MODE FOUND: use Server %s\n", ndpi_get_ip_string(ndpi_struct, &dst->ftp_ip)); } if (src != NULL) { ndpi_packet_dst_ip_get(packet, &src->ftp_ip); src->ftp_timer = packet->tick_timestamp; src->ftp_timer_set = 1; NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "saved ftp_ip, ftp_timer, ftp_timer_set to src"); NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP Extended PASSIVE MODE FOUND: use Server %s\n", ndpi_get_ip_string(ndpi_struct, &src->ftp_ip)); } return; } } static void search_active_ftp_mode(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (packet->payload_packet_len > 5 && (ndpi_mem_cmp(packet->payload, "PORT ", 5) == 0 || ndpi_mem_cmp(packet->payload, "EPRT ", 5) == 0)) { //src->local_ftp_data_port = htons(data_port_number); if (src != NULL) { ndpi_packet_dst_ip_get(packet, &src->ftp_ip); src->ftp_timer = packet->tick_timestamp; src->ftp_timer_set = 1; NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP ACTIVE MODE FOUND, command is %.*s\n", 4, packet->payload); } if (dst != NULL) { ndpi_packet_src_ip_get(packet, &dst->ftp_ip); dst->ftp_timer = packet->tick_timestamp; dst->ftp_timer_set = 1; NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP ACTIVE MODE FOUND, command is %.*s\n", 4, packet->payload); } } return; } void ndpi_search_ftp_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (src != NULL && ndpi_packet_dst_ip_eql(packet, &src->ftp_ip) && packet->tcp->syn != 0 && packet->tcp->ack == 0 && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_FTP) != 0 && src->ftp_timer_set != 0) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "possible ftp data, src!= 0.\n"); if (((u_int32_t) (packet->tick_timestamp - src->ftp_timer)) >= ndpi_struct->ftp_connection_timeout) { src->ftp_timer_set = 0; } else if (ntohs(packet->tcp->dest) > 1024 && (ntohs(packet->tcp->source) > 1024 || ntohs(packet->tcp->source) == 20)) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "detected FTP data stream.\n"); ndpi_int_ftp_add_connection(ndpi_struct, flow); return; } } if (dst != NULL && ndpi_packet_src_ip_eql(packet, &dst->ftp_ip) && packet->tcp->syn != 0 && packet->tcp->ack == 0 && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_FTP) != 0 && dst->ftp_timer_set != 0) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "possible ftp data; dst!= 0.\n"); if (((u_int32_t) (packet->tick_timestamp - dst->ftp_timer)) >= ndpi_struct->ftp_connection_timeout) { dst->ftp_timer_set = 0; } else if (ntohs(packet->tcp->dest) > 1024 && (ntohs(packet->tcp->source) > 1024 || ntohs(packet->tcp->source) == 20)) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "detected FTP data stream.\n"); ndpi_int_ftp_add_connection(ndpi_struct, flow); return; } } // ftp data asymmetrically /* skip packets without payload */ if (packet->payload_packet_len == 0) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "FTP test skip because of data connection or zero byte packet_payload.\n"); return; } /* skip excluded connections */ // we test for FTP connection and search for passive mode if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_FTP) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "detected ftp command mode. going to test data mode.\n"); search_passive_ftp_mode(ndpi_struct, flow); search_active_ftp_mode(ndpi_struct, flow); return; } if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && search_ftp(ndpi_struct, flow) != 0) { NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "unknown. need next packet.\n"); return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FTP); NDPI_LOG(NDPI_PROTOCOL_FTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude ftp.\n"); } #endif nDPI-2.2/src/lib/protocols/attic/manolito.c000066400000000000000000000155071321103654100206260ustar00rootroot00000000000000/* * manolito.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MANOLITO static void ndpi_int_manolito_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MANOLITO); if (src != NULL) { if (packet->udp != NULL) { src->manolito_last_pkt_arrival_time = packet->tick_timestamp; } } if (dst != NULL) { if (packet->udp != NULL) { dst->manolito_last_pkt_arrival_time = packet->tick_timestamp; } } } /* return 0 if nothing has been detected return 1 if it is a megaupload packet */ u_int8_t search_manolito_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); u_int8_t search_manolito_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src = flow->src; // struct ndpi_id_struct *dst = flow->dst; NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO TCP DETECTION\n"); if (flow->l4.tcp.manolito_stage == 0 && packet->payload_packet_len > 6) { if (memcmp(packet->payload, "SIZ ", 4) != 0) goto end_manolito_nothing_found; flow->l4.tcp.manolito_stage = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO Stage 1.\n"); goto end_manolito_maybe_hit; } else if ((flow->l4.tcp.manolito_stage == 2 - packet->packet_direction) && packet->payload_packet_len > 4) { if (memcmp(packet->payload, "STR ", 4) != 0) goto end_manolito_nothing_found; NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO Stage 2.\n"); flow->l4.tcp.manolito_stage = 3 + packet->packet_direction; goto end_manolito_maybe_hit; } else if ((flow->l4.tcp.manolito_stage == 4 - packet->packet_direction) && packet->payload_packet_len > 5) { if (memcmp(packet->payload, "MD5 ", 4) != 0) goto end_manolito_nothing_found; NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO Stage 3.\n"); flow->l4.tcp.manolito_stage = 5 + packet->packet_direction; goto end_manolito_maybe_hit; } else if ((flow->l4.tcp.manolito_stage == 6 - packet->packet_direction) && packet->payload_packet_len == 4) { if (memcmp(packet->payload, "GO!!", 4) != 0) goto end_manolito_nothing_found; NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO Stage 4.\n"); goto end_manolito_found; } //NDPI_LOG(NDPI_PROTOCOL_MANOLITO,ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO FLOW STAGE %d\n", flow->l4.tcp.manolito_stage); goto end_manolito_nothing_found; end_manolito_found: NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO FOUND\n"); ndpi_int_manolito_add_connection(ndpi_struct, flow); return 1; end_manolito_maybe_hit: NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO maybe hit.\n"); return 2; end_manolito_nothing_found: NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO NOTHING FOUND\n"); return 0; } void ndpi_search_manolito_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (packet->tcp != NULL) { if (search_manolito_tcp(ndpi_struct, flow) != 0) return; } else if (packet->udp != NULL) { if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_MANOLITO) { if (src != NULL) { src->manolito_last_pkt_arrival_time = packet->tick_timestamp; } if (dst != NULL) { dst->manolito_last_pkt_arrival_time = packet->tick_timestamp; } return; } else if (packet->udp->source == htons(41170) || packet->udp->dest == htons(41170)) { if (src != NULL && src->manolito_last_pkt_arrival_time != 0 && (packet->tick_timestamp - src->manolito_last_pkt_arrival_time < ndpi_struct->manolito_subscriber_timeout)) { NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO: UDP detected \n"); ndpi_int_manolito_add_connection(ndpi_struct, flow); return; } else if (src != NULL && (packet->tick_timestamp - src->manolito_last_pkt_arrival_time) >= ndpi_struct->manolito_subscriber_timeout) { src->manolito_last_pkt_arrival_time = 0; } if (dst != NULL && dst->manolito_last_pkt_arrival_time != 0 && (packet->tick_timestamp - dst->manolito_last_pkt_arrival_time < ndpi_struct->manolito_subscriber_timeout)) { NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO: UDP detected \n"); ndpi_int_manolito_add_connection(ndpi_struct, flow); return; } else if (dst != NULL && (packet->tick_timestamp - dst->manolito_last_pkt_arrival_time) >= ndpi_struct->manolito_subscriber_timeout) { dst->manolito_last_pkt_arrival_time = 0; } if ((packet->payload_packet_len == 20 && htons(0x3d4b) == get_u_int16_t(packet->payload, 0) && packet->payload[2] == 0xd9 && htons(0xedbb) == get_u_int16_t(packet->payload, 16)) || (packet->payload_packet_len == 25 && htons(0x3e4a) == get_u_int16_t(packet->payload, 0) && htons(0x092f) == get_u_int16_t(packet->payload, 20) && packet->payload[22] == 0x20) || (packet->payload_packet_len == 20 && !get_u_int16_t(packet->payload, 2) && !get_u_int32_t(packet->payload, 8) && !get_u_int16_t(packet->payload, 18) && get_u_int16_t(packet->payload, 0)) ) { //20B pkt is For PING NDPI_LOG(NDPI_PROTOCOL_MANOLITO, ndpi_struct, NDPI_LOG_DEBUG, "MANOLITO: UDP detected \n"); ndpi_int_manolito_add_connection(ndpi_struct, flow); return; } else if (flow->packet_counter < 7) { return; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MANOLITO); } #endif nDPI-2.2/src/lib/protocols/attic/popo.c000066400000000000000000000061541321103654100177570ustar00rootroot00000000000000/* * popo.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_POPO static void ndpi_int_popo_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_POPO); } void ndpi_search_popo_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (packet->tcp != NULL) { if ((packet->payload_packet_len == 20) && get_u_int32_t(packet->payload, 0) == htonl(0x0c000000) && get_u_int32_t(packet->payload, 4) == htonl(0x01010000) && get_u_int32_t(packet->payload, 8) == htonl(0x06000000) && get_u_int32_t(packet->payload, 12) == 0 && get_u_int32_t(packet->payload, 16) == 0) { NDPI_LOG(NDPI_PROTOCOL_POPO, ndpi_struct, NDPI_LOG_DEBUG, "POPO detected\n"); ndpi_int_popo_add_connection(ndpi_struct, flow); return; } if (NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_POPO) != 0) { #define NDPI_POPO_IP_SUBNET_START ( (220 << 24) + (181 << 16) + (28 << 8) + 220) #define NDPI_POPO_IP_SUBNET_END ( (220 << 24) + (181 << 16) + (28 << 8) + 238) /* may match the first payload ip packet only ... */ if (ntohl(packet->iph->daddr) >= NDPI_POPO_IP_SUBNET_START && ntohl(packet->iph->daddr) <= NDPI_POPO_IP_SUBNET_END) { NDPI_LOG(NDPI_PROTOCOL_POPO, ndpi_struct, NDPI_LOG_DEBUG, "POPO ip subnet detected\n"); ndpi_int_popo_add_connection(ndpi_struct, flow); return; } } } if (packet->payload_packet_len > 13 && packet->payload_packet_len == get_l32(packet->payload, 0) && !get_l16(packet->payload, 12)) { register u_int16_t ii; for (ii = 14; ii < 50 && ii < packet->payload_packet_len - 8; ++ii) { if (packet->payload[ii] == '@') if (!memcmp(&packet->payload[ii + 1], "163.com", 7) || (ii <= packet->payload_packet_len - 13 && !memcmp(&packet->payload[ii + 1], "popo.163.com", 12))) { NDPI_LOG(NDPI_PROTOCOL_POPO, ndpi_struct, NDPI_LOG_DEBUG, "POPO detected.\n"); ndpi_int_popo_add_connection(ndpi_struct, flow); return; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_POPO); } #endif nDPI-2.2/src/lib/protocols/attic/secondlife.c000066400000000000000000000131071321103654100211110ustar00rootroot00000000000000/* * secondlife.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_utils.h" #ifdef NDPI_PROTOCOL_SECONDLIFE static void ndpi_int_secondlife_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SECONDLIFE, protocol_type); } void ndpi_search_secondlife(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; // if ((ntohs(packet->udp->dest) == 12035 || ntohs(packet->udp->dest) == 12036 || (ntohs(packet->udp->dest) >= 13000 && ntohs(packet->udp->dest) <= 13050)) //port // && packet->payload_packet_len > 6 // min length with no extra header, high frequency and 1 byte message body // && get_u_int8_t(packet->payload, 0) == 0x40 // reliable packet // && ntohl(get_u_int32_t(packet->payload, 1)) == 0x00000001 // sequence number equals 1 // //ntohl (get_u_int32_t (packet->payload, 5)) == 0x00FFFF00 // no extra header, low frequency message - can't use, message may have higher frequency // ) { // NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life detected.\n"); // ndpi_int_secondlife_add_connection(ndpi_struct, flow); // return; // } if (packet->tcp != NULL) { if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /") && memcmp(packet->payload, "GET /", NDPI_STATICSTRING_LEN("GET /")) == 0) { NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life HTTP 'GET /'' found.\n"); ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->user_agent_line.ptr != NULL && packet->user_agent_line.len > NDPI_STATICSTRING_LEN ("Mozilla/5.0 (Windows; U; Windows NT 6.1; de-DE) AppleWebKit/532.4 (KHTML, like Gecko) SecondLife/") && memcmp(&packet->user_agent_line.ptr[NDPI_STATICSTRING_LEN ("Mozilla/5.0 (Windows; U; Windows NT 6.1; de-DE) AppleWebKit/532.4 (KHTML, like Gecko) ")], "SecondLife/", NDPI_STATICSTRING_LEN("SecondLife/")) == 0) { NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life TCP HTTP User Agent detected.\n"); ndpi_int_secondlife_add_connection(ndpi_struct, flow, NDPI_CORRELATED_PROTOCOL); return; } if (packet->host_line.ptr != NULL && packet->host_line.len > NDPI_STATICSTRING_LEN(".agni.lindenlab.com:")) { u_int8_t x; for (x = 2; x < 6; x++) { if (packet->host_line.ptr[packet->host_line.len - (1 + x)] == ':') { if ((1 + x + NDPI_STATICSTRING_LEN(".agni.lindenlab.com")) < packet->host_line.len && memcmp(&packet->host_line.ptr[packet->host_line.len - (1 + x + NDPI_STATICSTRING_LEN(".agni.lindenlab.com"))], ".agni.lindenlab.com", NDPI_STATICSTRING_LEN(".agni.lindenlab.com")) == 0) { NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life TCP HTTP Host detected.\n"); ndpi_int_secondlife_add_connection(ndpi_struct, flow, NDPI_CORRELATED_PROTOCOL); return; } break; } } } } } if (packet->udp != NULL) { if (packet->payload_packet_len == 46 && memcmp(packet->payload, "\x40\x00\x00\x00\x01\x00\xff\xff\x00\x03", 10) == 0) { NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life 0xffff0003 detected.\n"); ndpi_int_secondlife_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 54 && memcmp(packet->payload, "\x40\x00\x00\x00\x01\x00\xff\xff\x00\x52", 10) == 0) { NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life 0xffff0052 detected.\n"); ndpi_int_secondlife_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 58 && memcmp(packet->payload, "\x40\x00\x00\x00\x01\x00\xff\xff\x00\xa9", 10) == 0) { NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life 0xffff00a9 detected.\n"); ndpi_int_secondlife_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 54 && memcmp(packet->payload, "\x40\x00\x00\x00\x01\x00\x08", 7) == 0 && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life 0x08 detected.\n"); ndpi_int_secondlife_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_SECONDLIFE, ndpi_struct, NDPI_LOG_DEBUG, "Second Life excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SECONDLIFE); } #endif nDPI-2.2/src/lib/protocols/ayiya.c000066400000000000000000000047341321103654100170140ustar00rootroot00000000000000/* * ayiya.c * * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* http://en.wikipedia.org/wiki/Anything_In_Anything http://tools.ietf.org/html/rfc4891 */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_AYIYA struct ayiya { u_int8_t flags[3]; u_int8_t next_header; u_int32_t epoch; u_int8_t identity[16]; u_int8_t signature[20]; }; void ndpi_search_ayiya(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->udp && (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN)) { /* Ayiya is udp based, port 5072 */ if ((packet->udp->source == htons(5072) || packet->udp->dest == htons(5072)) /* check for ayiya new packet */ && (packet->payload_packet_len > 44) ) { /* FINISH */ struct ayiya *a = (struct ayiya*)packet->payload; u_int32_t epoch = ntohl(a->epoch), now; u_int32_t fiveyears = 86400 * 365 * 5; now = flow->packet.tick_timestamp; if((epoch >= (now - fiveyears)) && (epoch <= (now+86400 /* 1 day */))) ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_AYIYA, NDPI_PROTOCOL_UNKNOWN); return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_AYIYA); } } void init_ayiya_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Ayiya", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_AYIYA, ndpi_search_ayiya, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/battlefield.c000066400000000000000000000124031321103654100201470ustar00rootroot00000000000000/* * battlefield.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_BATTLEFIELD static void ndpi_int_battlefield_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BATTLEFIELD, NDPI_PROTOCOL_UNKNOWN); if (src != NULL) { src->battlefield_ts = packet->tick_timestamp; } if (dst != NULL) { dst->battlefield_ts = packet->tick_timestamp; } } void ndpi_search_battlefield(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_BATTLEFIELD) { if (src != NULL && ((u_int32_t) (packet->tick_timestamp - src->battlefield_ts) < ndpi_struct->battlefield_timeout)) { NDPI_LOG(NDPI_PROTOCOL_BATTLEFIELD, ndpi_struct, NDPI_LOG_DEBUG, "battlefield : save src connection packet detected\n"); src->battlefield_ts = packet->tick_timestamp; } else if (dst != NULL && ((u_int32_t) (packet->tick_timestamp - dst->battlefield_ts) < ndpi_struct->battlefield_timeout)) { NDPI_LOG(NDPI_PROTOCOL_BATTLEFIELD, ndpi_struct, NDPI_LOG_DEBUG, "battlefield : save dst connection packet detected\n"); dst->battlefield_ts = packet->tick_timestamp; } return; } if (NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_BATTLEFIELD)) { if (flow->l4.udp.battlefield_stage == 0 || flow->l4.udp.battlefield_stage == 1 + packet->packet_direction) { if (packet->payload_packet_len > 8 && get_u_int16_t(packet->payload, 0) == htons(0xfefd)) { flow->l4.udp.battlefield_msg_id = get_u_int32_t(packet->payload, 2); flow->l4.udp.battlefield_stage = 1 + packet->packet_direction; return; } } else if (flow->l4.udp.battlefield_stage == 2 - packet->packet_direction) { if (packet->payload_packet_len > 8 && get_u_int32_t(packet->payload, 0) == flow->l4.udp.battlefield_msg_id) { NDPI_LOG(NDPI_PROTOCOL_BATTLEFIELD, ndpi_struct, NDPI_LOG_DEBUG, "Battlefield message and reply detected.\n"); ndpi_int_battlefield_add_connection(ndpi_struct, flow); return; } } } if (flow->l4.udp.battlefield_stage == 0) { if (packet->payload_packet_len == 46 && packet->payload[2] == 0 && packet->payload[4] == 0 && get_u_int32_t(packet->payload, 7) == htonl(0x98001100)) { flow->l4.udp.battlefield_stage = 3 + packet->packet_direction; return; } } else if (flow->l4.udp.battlefield_stage == 4 - packet->packet_direction) { if (packet->payload_packet_len == 7 && (packet->payload[0] == 0x02 || packet->payload[packet->payload_packet_len - 1] == 0xe0)) { NDPI_LOG(NDPI_PROTOCOL_BATTLEFIELD, ndpi_struct, NDPI_LOG_DEBUG, "Battlefield message and reply detected.\n"); ndpi_int_battlefield_add_connection(ndpi_struct, flow); return; } } if (packet->payload_packet_len == 18 && memcmp(&packet->payload[5], "battlefield2\x00", 13) == 0) { NDPI_LOG(NDPI_PROTOCOL_BATTLEFIELD, ndpi_struct, NDPI_LOG_DEBUG, "Battlefield 2 hello packet detected.\n"); ndpi_int_battlefield_add_connection(ndpi_struct, flow); return; } else if (packet->payload_packet_len > 10 && (memcmp(packet->payload, "\x11\x20\x00\x01\x00\x00\x50\xb9\x10\x11", 10) == 0 || memcmp(packet->payload, "\x11\x20\x00\x01\x00\x00\x30\xb9\x10\x11", 10) == 0 || memcmp(packet->payload, "\x11\x20\x00\x01\x00\x00\xa0\x98\x00\x11", 10) == 0)) { NDPI_LOG(NDPI_PROTOCOL_BATTLEFIELD, ndpi_struct, NDPI_LOG_DEBUG, "Battlefield safe pattern detected.\n"); ndpi_int_battlefield_add_connection(ndpi_struct, flow); return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_BATTLEFIELD); return; } void init_battlefield_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("BattleField", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_BATTLEFIELD, ndpi_search_battlefield, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/bgp.c000066400000000000000000000044201321103654100164400ustar00rootroot00000000000000/* * bgp.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_BGP /* this detection also works asymmetrically */ void ndpi_search_bgp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t bgp_port = htons(179); if(packet->tcp) { if(packet->payload_packet_len > 18 && packet->payload[18] < 5 && ((packet->tcp->dest == bgp_port) || (packet->tcp->source == bgp_port)) && (get_u_int64_t(packet->payload, 0) == 0xffffffffffffffffULL) && (get_u_int64_t(packet->payload, 8) == 0xffffffffffffffffULL) && (ntohs(get_u_int16_t(packet->payload, 16)) <= packet->payload_packet_len)) { NDPI_LOG(NDPI_PROTOCOL_BGP, ndpi_struct, NDPI_LOG_DEBUG, "BGP detected.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BGP, NDPI_PROTOCOL_UNKNOWN); return; } } /* exclude BGP */ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_BGP); } void init_bgp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("BGP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_BGP, ndpi_search_bgp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/bittorrent.c000066400000000000000000000457061321103654100201000ustar00rootroot00000000000000/* * bittorrent.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_BITTORRENT #define NDPI_PROTOCOL_UNSAFE_DETECTION 0 #define NDPI_PROTOCOL_SAFE_DETECTION 1 #define NDPI_PROTOCOL_PLAIN_DETECTION 0 #define NDPI_PROTOCOL_WEBSEED_DETECTION 2 struct ndpi_utp_hdr { u_int8_t h_version:4, h_type:4, next_extension; u_int16_t connection_id; u_int32_t ts_usec, tdiff_usec, window_size; u_int16_t sequence_nr, ack_nr; }; static u_int8_t is_utp_pkt(const u_int8_t *payload, u_int payload_len) { struct ndpi_utp_hdr *h = (struct ndpi_utp_hdr*)payload; if(payload_len < sizeof(struct ndpi_utp_hdr)) return(0); if(h->h_version != 1) return(0); if(h->h_type > 4) return(0); if(h->next_extension > 2) return(0); if(ntohl(h->window_size) > 65565) return(0); return(1); } static void ndpi_add_connection_as_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, int bt_offset, int check_hash, const u_int8_t save_detection, const u_int8_t encrypted_connection) { if(check_hash) { const char *bt_hash = NULL; /* 20 bytes long */ if(bt_offset == -1) { const char *bt_magic = ndpi_strnstr((const char *)flow->packet.payload, "BitTorrent protocol", flow->packet.payload_packet_len); if(bt_magic) bt_hash = &bt_magic[19]; } else bt_hash = (const char*)&flow->packet.payload[28]; if(bt_hash) memcpy(flow->protos.bittorrent.hash, bt_hash, 20); } ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BITTORRENT, NDPI_PROTOCOL_UNKNOWN); } static u_int8_t ndpi_int_search_bittorrent_tcp_zero(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t a = 0; if(packet->payload_packet_len == 1 && packet->payload[0] == 0x13) { /* reset stage back to 0 so we will see the next packet here too */ flow->bittorrent_stage = 0; return 0; } if(flow->packet_counter == 2 && packet->payload_packet_len > 20) { if(memcmp(&packet->payload[0], "BitTorrent protocol", 19) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: plain BitTorrent protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, 19, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } } if(packet->payload_packet_len > 20) { /* test for match 0x13+"BitTorrent protocol" */ if(packet->payload[0] == 0x13) { if(memcmp(&packet->payload[1], "BitTorrent protocol", 19) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: plain BitTorrent protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, 20, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } } } if(packet->payload_packet_len > 23 && memcmp(packet->payload, "GET /webseed?info_hash=", 23) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: plain webseed BitTorrent protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION); return 1; } /* seen Azureus as server for webseed, possibly other servers existing, to implement */ /* is Server: hypertracker Bittorrent? */ /* no asymmetric detection possible for answer of pattern "GET /data?fid=". */ if(packet->payload_packet_len > 60 && memcmp(packet->payload, "GET /data?fid=", 14) == 0 && memcmp(&packet->payload[54], "&size=", 6) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: plain Bitcomet persistent seed protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION); return 1; } if(packet->payload_packet_len > 90 && (memcmp(packet->payload, "GET ", 4) == 0 || memcmp(packet->payload, "POST ", 5) == 0)) { const u_int8_t *ptr = &packet->payload[4]; u_int16_t len = packet->payload_packet_len - 4; /* parse complete get packet here into line structure elements */ ndpi_parse_packet_line_info(ndpi_struct, flow); /* answer to this pattern is HTTP....Server: hypertracker */ if(packet->user_agent_line.ptr != NULL && ((packet->user_agent_line.len > 8 && memcmp(packet->user_agent_line.ptr, "Azureus ", 8) == 0) || (packet->user_agent_line.len >= 10 && memcmp(packet->user_agent_line.ptr, "BitTorrent", 10) == 0) || (packet->user_agent_line.len >= 11 && memcmp(packet->user_agent_line.ptr, "BTWebClient", 11) == 0))) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "Azureus /Bittorrent user agent line detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION); return 1; } if(packet->user_agent_line.ptr != NULL && (packet->user_agent_line.len >= 9 && memcmp(packet->user_agent_line.ptr, "Shareaza ", 9) == 0) && (packet->parsed_lines > 8 && packet->line[8].ptr != 0 && packet->line[8].len >= 9 && memcmp(packet->line[8].ptr, "X-Queue: ", 9) == 0)) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "Bittorrent Shareaza detected.\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION); return 1; } /* this is a self built client, not possible to catch asymmetrically */ if((packet->parsed_lines == 10 || (packet->parsed_lines == 11 && packet->line[11].len == 0)) && packet->user_agent_line.ptr != NULL && packet->user_agent_line.len > 12 && memcmp(packet->user_agent_line.ptr, "Mozilla/4.0 ", 12) == 0 && packet->host_line.ptr != NULL && packet->host_line.len >= 7 && packet->line[2].ptr != NULL && packet->line[2].len > 14 && memcmp(packet->line[2].ptr, "Keep-Alive: 300", 15) == 0 && packet->line[3].ptr != NULL && packet->line[3].len > 21 && memcmp(packet->line[3].ptr, "Connection: Keep-alive", 22) == 0 && packet->line[4].ptr != NULL && packet->line[4].len > 10 && (memcmp(packet->line[4].ptr, "Accpet: */*", 11) == 0 || memcmp(packet->line[4].ptr, "Accept: */*", 11) == 0) && packet->line[5].ptr != NULL && packet->line[5].len > 12 && memcmp(packet->line[5].ptr, "Range: bytes=", 13) == 0 && packet->line[7].ptr != NULL && packet->line[7].len > 15 && memcmp(packet->line[7].ptr, "Pragma: no-cache", 16) == 0 && packet->line[8].ptr != NULL && packet->line[8].len > 22 && memcmp(packet->line[8].ptr, "Cache-Control: no-cache", 23) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "Bitcomet LTS detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_UNSAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } /* FlashGet pattern */ if(packet->parsed_lines == 8 && packet->user_agent_line.ptr != NULL && packet->user_agent_line.len > (sizeof("Mozilla/4.0 (compatible; MSIE 6.0;") - 1) && memcmp(packet->user_agent_line.ptr, "Mozilla/4.0 (compatible; MSIE 6.0;", sizeof("Mozilla/4.0 (compatible; MSIE 6.0;") - 1) == 0 && packet->host_line.ptr != NULL && packet->host_line.len >= 7 && packet->line[2].ptr != NULL && packet->line[2].len == 11 && memcmp(packet->line[2].ptr, "Accept: */*", 11) == 0 && packet->line[3].ptr != NULL && packet->line[3].len >= (sizeof("Referer: ") - 1) && memcmp(packet->line[3].ptr, "Referer: ", sizeof("Referer: ") - 1) == 0 && packet->line[5].ptr != NULL && packet->line[5].len > 13 && memcmp(packet->line[5].ptr, "Range: bytes=", 13) == 0 && packet->line[6].ptr != NULL && packet->line[6].len > 21 && memcmp(packet->line[6].ptr, "Connection: Keep-Alive", 22) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "FlashGet detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_UNSAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } if(packet->parsed_lines == 7 && packet->user_agent_line.ptr != NULL && packet->user_agent_line.len > (sizeof("Mozilla/4.0 (compatible; MSIE 6.0;") - 1) && memcmp(packet->user_agent_line.ptr, "Mozilla/4.0 (compatible; MSIE 6.0;", sizeof("Mozilla/4.0 (compatible; MSIE 6.0;") - 1) == 0 && packet->host_line.ptr != NULL && packet->host_line.len >= 7 && packet->line[2].ptr != NULL && packet->line[2].len == 11 && memcmp(packet->line[2].ptr, "Accept: */*", 11) == 0 && packet->line[3].ptr != NULL && packet->line[3].len >= (sizeof("Referer: ") - 1) && memcmp(packet->line[3].ptr, "Referer: ", sizeof("Referer: ") - 1) == 0 && packet->line[5].ptr != NULL && packet->line[5].len > 21 && memcmp(packet->line[5].ptr, "Connection: Keep-Alive", 22) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "FlashGet detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_UNSAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } /* answer to this pattern is not possible to implement asymmetrically */ while (1) { if(len < 50 || ptr[0] == 0x0d) { goto ndpi_end_bt_tracker_check; } if(memcmp(ptr, "info_hash=", 10) == 0) { break; } len--; ptr++; } NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, " BT stat: tracker info hash found\n"); /* len is > 50, so save operation here */ len -= 10; ptr += 10; /* parse bt hash */ for (a = 0; a < 20; a++) { if(len < 3) { goto ndpi_end_bt_tracker_check; } if(*ptr == '%') { u_int8_t x1 = 0xFF; u_int8_t x2 = 0xFF; if(ptr[1] >= '0' && ptr[1] <= '9') { x1 = ptr[1] - '0'; } if(ptr[1] >= 'a' && ptr[1] <= 'f') { x1 = 10 + ptr[1] - 'a'; } if(ptr[1] >= 'A' && ptr[1] <= 'F') { x1 = 10 + ptr[1] - 'A'; } if(ptr[2] >= '0' && ptr[2] <= '9') { x2 = ptr[2] - '0'; } if(ptr[2] >= 'a' && ptr[2] <= 'f') { x2 = 10 + ptr[2] - 'a'; } if(ptr[2] >= 'A' && ptr[2] <= 'F') { x2 = 10 + ptr[2] - 'A'; } if(x1 == 0xFF || x2 == 0xFF) { goto ndpi_end_bt_tracker_check; } ptr += 3; len -= 3; } else if(*ptr >= 32 && *ptr < 127) { ptr++; len--; } else { goto ndpi_end_bt_tracker_check; } } NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, " BT stat: tracker info hash parsed\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } ndpi_end_bt_tracker_check: if(packet->payload_packet_len == 80) { /* Warez 80 Bytes Packet * +----------------+---------------+-----------------+-----------------+ * |20 BytesPattern | 32 Bytes Value| 12 BytesPattern | 16 Bytes Data | * +----------------+---------------+-----------------+-----------------+ * 20 BytesPattern : 4c 00 00 00 ff ff ff ff 57 00 00 00 00 00 00 00 20 00 00 00 * 12 BytesPattern : 28 23 00 00 01 00 00 00 10 00 00 00 * */ static const char pattern_20_bytes[20] = { 0x4c, 0x00, 0x00, 0x00, 0xff, 0xff, 0xff, 0xff, 0x57, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00 }; static const char pattern_12_bytes[12] = { 0x28, 0x23, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00 }; /* did not see this pattern anywhere */ if((memcmp(&packet->payload[0], pattern_20_bytes, 20) == 0) && (memcmp(&packet->payload[52], pattern_12_bytes, 12) == 0)) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: Warez - Plain BitTorrent protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return 1; } } else if(packet->payload_packet_len > 50) { if(memcmp(packet->payload, "GET", 3) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); /* haven't fount this pattern anywhere */ if(packet->host_line.ptr != NULL && packet->host_line.len >= 9 && memcmp(packet->host_line.ptr, "ip2p.com:", 9) == 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: Warez - Plain BitTorrent protocol detected due to Host: ip2p.com: pattern\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_WEBSEED_DETECTION); return 1; } } } return 0; } /*Search for BitTorrent commands*/ static void ndpi_int_search_bittorrent_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->payload_packet_len == 0) { return; } if(flow->bittorrent_stage == 0 && packet->payload_packet_len != 0) { /* exclude stage 0 detection from next run */ flow->bittorrent_stage = 1; if(ndpi_int_search_bittorrent_tcp_zero(ndpi_struct, flow) != 0) { NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_DEBUG, "stage 0 has detected something, returning\n"); return; } NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_DEBUG, "stage 0 has no direct detection, fall through\n"); } return; } void ndpi_search_bittorrent(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; char *bt_proto = NULL; /* This is broadcast */ if(packet->iph && (((packet->iph->saddr == 0xFFFFFFFF) || (packet->iph->daddr == 0xFFFFFFFF)) || (packet->udp && ((ntohs(packet->udp->source) == 3544) /* teredo.c */ || (ntohs(packet->udp->dest) == 3544))))) { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_BITTORRENT); return; } if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_BITTORRENT) { /* check for tcp retransmission here */ if((packet->tcp != NULL) && (packet->tcp_retransmission == 0 || packet->num_retried_bytes)) { ndpi_int_search_bittorrent_tcp(ndpi_struct, flow); } else if(packet->udp != NULL) { char *bt_search = "BT-SEARCH * HTTP/1.1\r\n"; if((ntohs(packet->udp->source) < 1024) || (ntohs(packet->udp->dest) < 1024) /* High ports only */) return; /* Check for uTP http://www.bittorrent.org/beps/bep_0029.html wireshark/epan/dissectors/packet-bt-utp.c */ if(packet->payload_packet_len >= 23 /* min header size */) { if(strncmp((const char*)packet->payload, bt_search, strlen(bt_search)) == 0) { ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 1, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return; } else { /* Check if this is protocol v0 */ u_int8_t v0_extension = packet->payload[17]; u_int8_t v0_flags = packet->payload[18]; /* Check if this is protocol v1 */ u_int8_t v1_version = packet->payload[0]; u_int8_t v1_extension = packet->payload[1]; u_int32_t v1_window_size = *((u_int32_t*)&packet->payload[12]); if(is_utp_pkt(packet->payload, packet->payload_packet_len)) goto bittorrent_found; else if((packet->payload[0]== 0x60) && (packet->payload[1]== 0x0) && (packet->payload[2]== 0x0) && (packet->payload[3]== 0x0) && (packet->payload[4]== 0x0)) { /* Heuristic */ bt_proto = ndpi_strnstr((const char *)&packet->payload[20], "BitTorrent protocol", packet->payload_packet_len-20); goto bittorrent_found; /* CSGO/DOTA conflict */ } else if(flow->packet_counter > 8 && ((v1_version & 0x0f) == 1) && ((v1_version >> 4) < 5 /* ST_NUM_STATES */) && (v1_extension < 3 /* EXT_NUM_EXT */) && (v1_window_size < 32768 /* 32k */) ) { bt_proto = ndpi_strnstr((const char *)&packet->payload[20], "BitTorrent protocol", packet->payload_packet_len-20); goto bittorrent_found; } else if((v0_flags < 6 /* ST_NUM_STATES */) && (v0_extension < 3 /* EXT_NUM_EXT */)) { u_int32_t ts = ntohl(*((u_int32_t*)&(packet->payload[4]))); u_int32_t now; now = (u_int32_t)time(NULL); if((ts < (now+86400)) && (ts > (now-86400))) { bt_proto = ndpi_strnstr((const char *)&packet->payload[20], "BitTorrent protocol", packet->payload_packet_len-20); goto bittorrent_found; } } } } flow->bittorrent_stage++; if(flow->bittorrent_stage < 10) { /* We have detected bittorrent but we need to wait until we get a hash */ if(packet->payload_packet_len > 19 /* min size */) { if(ndpi_strnstr((const char *)packet->payload, ":target20:", packet->payload_packet_len) || ndpi_strnstr((const char *)packet->payload, ":find_node1:", packet->payload_packet_len) || ndpi_strnstr((const char *)packet->payload, "d1:ad2:id20:", packet->payload_packet_len) || ndpi_strnstr((const char *)packet->payload, ":info_hash20:", packet->payload_packet_len) || ndpi_strnstr((const char *)packet->payload, ":filter64", packet->payload_packet_len) || ndpi_strnstr((const char *)packet->payload, "d1:rd2:id20:", packet->payload_packet_len) || (bt_proto = ndpi_strnstr((const char *)packet->payload, "BitTorrent protocol", packet->payload_packet_len)) ) { bittorrent_found: if(bt_proto && (packet->payload_packet_len > 47)) memcpy(flow->protos.bittorrent.hash, &bt_proto[27], 20); NDPI_LOG(NDPI_PROTOCOL_BITTORRENT, ndpi_struct, NDPI_LOG_TRACE, "BT: plain BitTorrent protocol detected\n"); ndpi_add_connection_as_bittorrent(ndpi_struct, flow, -1, 0, NDPI_PROTOCOL_SAFE_DETECTION, NDPI_PROTOCOL_PLAIN_DETECTION); return; } } return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_BITTORRENT); } } } void init_bittorrent_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("BitTorrent", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_BITTORRENT, ndpi_search_bittorrent, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/bjnp.c000066400000000000000000000040121321103654100166160ustar00rootroot00000000000000#include "ndpi_api.h" #ifdef NDPI_PROTOCOL_BJNP static void ndpi_int_bjnp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t due_to_correlation) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_BJNP, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_bjnp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { if(payload_len > 4) { if((memcmp((const char *)packet->payload, "BJNP", 4) == 0) || (memcmp((const char *)packet->payload, "BNJB", 4) == 0) || (memcmp((const char *)packet->payload, "BJNB", 4) == 0) || (memcmp((const char *)packet->payload, "MFNP", 4) == 0) ) { NDPI_LOG(NDPI_PROTOCOL_BJNP, ndpi_struct, NDPI_LOG_DEBUG, "Found bjnp.\n"); ndpi_int_bjnp_add_connection(ndpi_struct, flow, 0); return; } } } NDPI_LOG(NDPI_PROTOCOL_BJNP, ndpi_struct, NDPI_LOG_DEBUG, "exclude bjnp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_BJNP); } void ndpi_search_bjnp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_BJNP, ndpi_struct, NDPI_LOG_DEBUG, "bjnp detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_BJNP) { if (packet->tcp_retransmission == 0) { ndpi_check_bjnp(ndpi_struct, flow); } } } void init_bjnp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("BJNP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_BJNP, ndpi_search_bjnp, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/btlib.c000066400000000000000000000304261321103654100167710ustar00rootroot00000000000000/* * btlib.c * * Copyright (C) 2011-15 - ntop.org * Contributed by Vitaly Lavrov * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #ifndef NDPI_NO_STD_INC #include #include #include #include #include typedef unsigned char u_int8_t; typedef unsigned short int u_int16_t; typedef unsigned long long int u_int64_t; #include #include #include #endif typedef signed long long int i_int64_t; #include "btlib.h" int bt_parse_debug = 0; static char *printXb(char *s,const u_int8_t *b,int l) { int i; for(i=0; i < l; i++) snprintf(&s[i*2],41,"%02x",b[i]); return s; } static char *print20b(char *s,const u_int8_t *b) { snprintf(s,41,"%08x%08x%08x%08x%08x", htonl(*(u_int32_t*)b), htonl(*(u_int32_t*)(b+4)), htonl(*(u_int32_t*)(b+8)), htonl(*(u_int32_t*)(b+12)), htonl(*(u_int32_t*)(b+16))); return s; } static char *print_id_ip_p(char *s, const struct bt_nodes_data *b) { u_int8_t *p = (void*)b; print20b(s,b->id); snprintf(s+40,39," %d.%d.%d.%d:%u", p[20], p[21], p[22], p[23], htons(b->port)); return s; } static char *print_ip_p(char *s, const struct bt_ipv4p *b,int np) { const u_int8_t *p = (const void*)b; snprintf(s,39,!np ? "%d.%d.%d.%d:%u":"%d.%d.%d.%d", p[0], p[1], p[2], p[3], htons(b->port)); return s; } static char *print_ip6_p(char *s, const struct bt_ipv6p *b,int np) { u_int16_t *p = (void*)b; snprintf(s,79,!np ? "%x:%x:%x:%x:%x:%x:%x:%x.%u":"%x:%x:%x:%x:%x:%x:%x:%x", htons(p[0]), htons(p[1]), htons(p[2]), htons(p[3]), htons(p[4]), htons(p[5]), htons(p[6]), htons(p[7]), htons(b->port)); return s; } static char *print_id_ip6_p(char *s,const struct bt_nodes6_data *b) { return print_ip6_p(s,(struct bt_ipv6p *)&b->ip,0); } void dump_bt_proto_struct(struct bt_parse_protocol *p) { char b20h[128]; int i; if(p->y_e && p->e_msg) { printf("Error %s/%u\n", p->e_msg, p->e_len); } if(p->y_q) { printf("Query "); if(p->q_ping) printf("ping\n"); if(p->q_g_peers) printf("get_peers\n"); if(p->q_f_node) printf("find_node\n"); if(p->q_a_peer) printf("announce_peer\n"); } if(p->y_r) printf("Reply\n"); if(p->t) printf("\tt\t%llx\n",p->t); if(p->v) printf("\tv\t%llx\n",p->v); if(p->ip) printf("\tIP\t%s\n",print_ip_p(b20h,p->ip,0)); if(p->a.port) printf("\tport\t%d\n",htons(p->a.port)); if(p->a.id) printf("\tID\t%s\n",print20b(b20h,p->a.id)); if(p->a.target) printf("\ttarget\t%s\n",print20b(b20h,p->a.target)); if(p->a.token) printf("\ttoken\t%s\n",printXb(b20h,p->a.token,p->a.t_len)); if(p->a.info_hash) printf("\ti_hash\t%s\n",print20b(b20h,p->a.info_hash)); if(p->a.name && p->a.name_len) printf("\tname\t%.*s\n",p->a.name_len,p->a.name); if(p->r.ip) printf("\tip\t%s\n",print_ip_p(b20h,p->r.ip,1)); if(p->r.port) printf("\tport\t%d\n",htons(p->r.port)); if(p->r.id) printf("\tID\t%s\n",print20b(b20h,p->r.id)); if(p->r.token) printf("\ttoken\t%s\n",printXb(b20h,p->r.token,p->r.t_len)); if(p->r.name && p->r.name_len) printf("\tname\t%.*s\n",p->r.name_len,p->r.name); if(p->r.values && p->r.nv) { struct bt_ipv4p2 *n = (struct bt_ipv4p2 *)p->r.values; for(i=0;i < p->r.nv; i++,n++) { printf("\tvalues\t%s\n", print_ip_p(b20h,&n->d,0)); } } if(p->r.values6 && p->r.nv6) { struct bt_ipv6p2 *n = (struct bt_ipv6p2 *)p->r.values6; for(i=0;i < p->r.nv6; i++,n++) { printf("\tvalues6\t%s\n", print_ip6_p(b20h,&n->d,0)); } } if(p->r.nodes && p->r.nn) { for(i=0;i < p->r.nn; i++) { printf("\tnodes\t%s\n",print_id_ip_p(b20h,p->r.nodes+i)); } } if(p->r.nodes6 && p->r.nn6) { for(i=0;i < p->r.nn6; i++) { printf("\tnodes6\t%s\n",print_id_ip6_p(b20h,p->r.nodes6+i)); } } if(p->peers && p->n_peers) { for(i=0;i < p->n_peers; i++) { printf("\tpeers\t%s\n",print_ip_p(b20h,p->peers+i,0)); } } if(p->interval) printf("\tinterval\t%d\n",p->interval); if(p->min_interval) printf("\tmin interval\t%d\n",p->min_interval); } static void _print_safe_str(char *msg,char *k,const u_int8_t *s,size_t l) { static const char *th="0123456789abcdef?"; char *buf = (char*)ndpi_malloc((size_t)(l*3+2)); int sl = l; if(buf) { char *b = buf; for(;l > 0; s++,l--) { if(*s < ' ' || *s >= 127) { *b++ = '%'; *b++ = th[(*s >> 4)&0xf]; *b++ = th[(*s)&0xf]; } else *b++ = *s; } *b = 0; printf("%s %s %s len %d\n",msg,k,buf ? buf:"",sl); ndpi_free(buf); } } static void print_safe_str(char *msg,bt_parse_data_cb_t *cbd) { _print_safe_str(msg,cbd->buf,cbd->v.s.s,cbd->v.s.l); } #define DEBUG_TRACE(cmd) { if(bt_parse_debug) cmd; } #define STREQ(a,b) !strcmp(a,b) void cb_data(bt_parse_data_cb_t *cbd,int *ret) { struct bt_parse_protocol *p = &(cbd->p); const u_int8_t *s; const char *ss; if(cbd->t == 0) return; if(cbd->t == 1) { DEBUG_TRACE(printf("%s %lld\n",cbd->buf,cbd->v.i)); if(STREQ(cbd->buf,"a.port")) { p->a.port = (u_int16_t)(cbd->v.i & 0xffff); return; } if( STREQ(cbd->buf,"a.implied_port") || STREQ(cbd->buf,"a.noseed") || STREQ(cbd->buf,"a.scrape") || STREQ(cbd->buf,"a.seed") || STREQ(cbd->buf,"a.vote") ) { return; } if(STREQ(cbd->buf,"r.port") || STREQ(cbd->buf,"r.p")) { p->r.port = (u_int16_t)(cbd->v.i & 0xffff); return; } if(STREQ(cbd->buf,"interval")) { p->interval = (u_int16_t)(cbd->v.i & 0x7fffffff); p->h_int = 1; return; } if(STREQ(cbd->buf,"min interval")) { p->min_interval = (u_int16_t)(cbd->v.i & 0x7fffffff); p->h_mint = 1; return; } DEBUG_TRACE(printf("UNKNOWN %s %lld\n",cbd->buf,cbd->v.i)); return; } if(cbd->t != 2) { DEBUG_TRACE(printf("BUG! t=%d %s\n",cbd->t,cbd->buf)); return; } DEBUG_TRACE(print_safe_str("",cbd)); s = cbd->v.s.s; ss = (char *)s; if(STREQ(cbd->buf,"a.id")) { p->a.id = s; return; } if(STREQ(cbd->buf,"a.info_hash")) { p->a.info_hash = s; return; } if(STREQ(cbd->buf,"a.target")) { p->a.target = s; return; } if(STREQ(cbd->buf,"a.token")) { p->a.token = s; p->a.t_len = cbd->v.s.l; return; } if(STREQ(cbd->buf,"a.name")) { p->a.name = s; p->a.name_len = cbd->v.s.l; return; } if(STREQ(cbd->buf,"a.want")) { return; } if(STREQ(cbd->buf,"r.id")) { p->r.id = s; return; } if(STREQ(cbd->buf,"r.ip")) { if(cbd->v.s.l != 4) { DEBUG_TRACE(printf("BUG! r.ip with port\n")); return; } p->r.ip = (struct bt_ipv4p *)s; return; } if(STREQ(cbd->buf,"r.token")) { p->r.token = s; p->r.t_len = cbd->v.s.l; return; } if(STREQ(cbd->buf,"r.values")) { if(cbd->v.s.l == 18) { if(!p->r.values6) { p->r.values6 = s; p->r.nv6 = 1; } else { if(s != p->r.values6+(p->r.nv6*21)) { // DEBUG_TRACE(printf("BUG! r.values6 not in list! %08x %08x \n", p->r.values+(p->r.nv6*21),s)); return; } p->r.nv6++; } return; } if(cbd->v.s.l == 6) { if(!p->r.values) { p->r.values = s; p->r.nv = 1; } else { if(s != p->r.values+(p->r.nv*8)) { // DEBUG_TRACE(printf("BUG! r.values not in list! %u \n",s-p->r.values+(p->r.nv*8))); return; } p->r.nv++; } return; } return; } if(STREQ(cbd->buf,"r.name") || STREQ(cbd->buf,"r.n")) { p->r.name = s; p->r.name_len = cbd->v.s.l; return; } if(STREQ(cbd->buf,"r.nodes")) { if(cbd->v.s.l % 26) { // DEBUG_TRACE(printf("BUG! r.nodes length %d not %% 26\n",cbd->v.s.l)); return; } p->r.nodes = (struct bt_nodes_data *)s; p->r.nn = cbd->v.s.l / 26; return; } if(STREQ(cbd->buf,"r.nodes6")) { if(cbd->v.s.l % 38) { // DEBUG_TRACE(printf("BUG! r.nodes length %d not %% 38\n",cbd->v.s.l)); return; } p->r.nodes6 = (struct bt_nodes6_data *)s; p->r.nn6 = cbd->v.s.l / 38; return; } if(cbd->buf[0] == 'y' && !cbd->buf[1]) { if(cbd->v.s.l != 1) return; if(*ss == 'q') { p->y_q = 1; return; } if(*ss == 'r') { p->y_r = 1; return; } if(*ss == 'e') { p->y_e = 1; return; } return; } if(cbd->buf[0] == 'q' && !cbd->buf[1]) { if(!strncmp(ss,"announce_peer",13)) { p->q_a_peer = 1; return; } if(!strncmp(ss,"find_node",9)) { p->q_f_node = 1; return; } if(!strncmp(ss,"get_peers",9)) { p->q_g_peers = 1; return; } if(!strncmp(ss,"ping",4)) { p->q_ping = 1; return; } if(!strncmp(ss,"vote",4)) { return; } } if(STREQ(cbd->buf,"ip")) { if(cbd->v.s.l != 6) { // DEBUG_TRACE(printf("BUG! r.ip w/o port\n")); } p->ip = (struct bt_ipv4p *)s; p->h_ip = 1; return; } if(STREQ(cbd->buf,"peers")) { if(cbd->v.s.l % 6) return; p->peers = (struct bt_ipv4p *)s; p->n_peers = cbd->v.s.l / 6; return; } if((*cbd->buf == 't' || *cbd->buf == 'v') && !cbd->buf[1]) { u_int64_t d = *(u_int64_t*)s; switch(cbd->v.s.l) { case 2: d &= 0xffffllu; d = htons(d); break; case 4: d &= 0xffffffffllu; d = htonl(d); break; case 6: d &= 0xffffffffffffllu; d = (htonl(d & 0xffffffff) << 16) | (htons(d >> 32) & 0xffff); break; case 8: d = ((u_int64_t)htonl(d & 0xffffffff) << 32) | htonl(d >> 32); break; default: d = 0; } if(*cbd->buf == 'v') cbd->p.v = d; else cbd->p.t = d; return; } if(cbd->buf[0] == 'e') { p->e_msg = s; p->e_len = cbd->v.s.l; return; } // DEBUG_TRACE(print_safe_str("UNKNOWN",cbd)); } const u_int8_t *bt_decode(const u_int8_t *b, size_t *l, int *ret, bt_parse_data_cb_t *cbd) { unsigned int n=0,neg=0; i_int64_t d = 0; register u_int8_t c; if(*l == 0) return NULL; if(cbd->level > BDEC_MAXDEPT) goto bad_data; c = *b++; (*l)--; if(c == 'i') { // integer while(*l) { c = *b++; (*l)--; n++; if(c == '-') { if(n != 1) goto bad_data; n--; neg=1; continue; } if(c >= '0' && c <= '9') { if(c == '0' && n > 1 && !d && *b != 'e') goto bad_data; d *= 10; d += c-'0'; continue; } if(c != 'e') goto bad_data; break; } if(neg) d=-d; cbd->t = 1; cbd->v.i = neg ? -d:d; return b; } if(c >= '1' && c <= '9') { //string d=c-'0'; while(*l) { c = *b++; (*l)--; n++; if(c >= '0' && c <= '9') { if(c == '0' && n > 1 && d == 0) goto bad_data; d *= 10; d += c-'0'; continue; } if(c != ':') goto bad_data; break; } if(d > *l) goto bad_data; cbd->t = 2; cbd->v.s.s = b; cbd->v.s.l = d; b += d; *l -= d; return b; } if(c == 'l') { cbd->level++; do { b = bt_decode(b,l,ret,cbd); if(*ret < 0 || *l == 0) goto bad_data; cb_data(cbd,ret); if(*ret < 0) goto bad_data; cbd->t = 0; } while (*b != 'e' && *l != 0); b++; (*l)--; cbd->level--; return b; } if(c == 'd') { cbd->level++; do { char *ls = cbd->buf + strlen(cbd->buf); int l1 = ls != cbd->buf ? 1:0; if(!(*b >= '1' && *b <= '9')) goto bad_data; b = bt_decode(b,l,ret,cbd); if(*ret < 0 || *l == 0) goto bad_data; if(ls+cbd->v.s.l+l1 < &cbd->buf[sizeof(cbd->buf)-1]) { if(l1) ls[0]='.'; strncpy(ls+l1,(char *)cbd->v.s.s,cbd->v.s.l); ls[cbd->v.s.l+l1]=0; } b = bt_decode(b,l,ret,cbd); if(*ret < 0 || *l == 0) goto bad_data; cb_data(cbd,ret); if(*ret < 0) goto bad_data; cbd->t = 0; *ls = 0; } while (*b != 'e' && l != 0); b++; (*l)--; cbd->level--; return b; } bad_data: *ret=-1; return b; } nDPI-2.2/src/lib/protocols/btlib.h000066400000000000000000000070141321103654100167730ustar00rootroot00000000000000/* * btlib.h * * Copyright (C) 2011-15 - ntop.org * Contributed by Vitaly Lavrov * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #define BDEC_MAXDEPT 8 #ifdef WIN32 #include "ndpi_win32.h" #endif typedef struct b_elem_s { const u_int8_t *s; size_t l; } b_elem_s_t; #ifdef WIN32 // enable 1 byte packing on Windows #include #endif struct #ifndef WIN32 __attribute__((__packed__)) #endif bt_nodes_data { u_int8_t id[20]; u_int32_t ip; u_int16_t port; }; struct #ifndef WIN32 __attribute__((__packed__)) #endif bt_ipv4p { u_int32_t ip; u_int16_t port; }; struct #ifndef WIN32 __attribute__((__packed__)) #endif bt_ipv4p2 { struct bt_ipv4p d; u_int8_t pad[2]; }; struct #ifndef WIN32 __attribute__((__packed__)) #endif bt_nodes6_data { u_int8_t id[20]; u_int32_t ip[4]; u_int16_t port; }; struct #ifndef WIN32 __attribute__((__packed__)) #endif bt_ipv6p { u_int32_t ip[4]; u_int16_t port; }; struct #ifndef WIN32 __attribute__((__packed__)) #endif bt_ipv6p2 { struct bt_ipv6p d; u_int8_t pad[3]; }; #ifdef WIN32 // disable 1 byte packing #include #endif /* a.id S r.id S a.info_hash S r.ip ipv4 a.name S r.nodes x(id,ipv4,port) -a.noseed 0|1 r.n S name of file a.port N r.p port -a.scrape 0|1 r.token S -a.seed 0|1 r.values x(ipv4,port) a.target S a.token S -a.vote N -a.want n4|n6 q announce_peer q find_node q get_peers q ping -q vote ip ipv4+port interval N min interval N peers x(ipv4,port) t 2/4/8b v 4/6b e S y e y r y q */ struct bt_parse_protocol { u_int16_t y_e:1, y_r:1, y_q:1, q_a_peer:1,q_f_node:1, q_g_peers:1,q_ping:1, h_int:1,h_mint:1,h_ip:1; struct { const u_int8_t *id, // 20 *info_hash, // 20 *target, // 20 *token, // 20|8 *name; // varlen u_int16_t name_len; u_int16_t port; u_int16_t t_len; } a; struct { const u_int8_t *id, // 20 *token, // 20|8 *values, // (6+2)*x *values6, // (18_3)*x *name; // varlen struct bt_ipv4p *ip; struct bt_nodes_data *nodes; struct bt_nodes6_data *nodes6; u_int16_t name_len; u_int16_t nn; // nodes num u_int16_t nv; // values num u_int16_t nn6; // nodes6 num u_int16_t nv6; // values6 num u_int16_t port; u_int16_t t_len; } r; int interval,min_interval; struct bt_ipv4p *peers; int n_peers; struct bt_ipv4p *ip; const u_int8_t *e_msg; u_int16_t e_len; u_int64_t t,v; }; typedef struct bt_parse_data_cb { struct bt_parse_protocol p; char buf[64]; int level; int t; union { i_int64_t i; b_elem_s_t s; } v; } bt_parse_data_cb_t; extern int bt_parse_debug; void dump_bt_proto_struct(struct bt_parse_protocol *p); const u_int8_t *bt_decode(const u_int8_t *b, size_t *l, int *ret, bt_parse_data_cb_t *cbd); nDPI-2.2/src/lib/protocols/checkmk.c000077500000000000000000000053561321103654100173110ustar00rootroot00000000000000/* * checkmk.c * * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_CHECKMK static void ndpi_int_checkmk_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CHECKMK, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_checkmk(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->payload_packet_len >= 15) { if(packet->payload_packet_len > 128) { /* When we transfer a large data chunk, unless we have observed the initial connection, we need to discard these packets as they are not an indication that this flow is not AFP */ return; } /* * this will detect the OpenSession command of the Data Stream Interface (DSI) protocol * which is exclusively used by the Apple Filing Protocol (AFP) on TCP/IP networks */ if (packet->payload_packet_len >= 15 && packet->payload_packet_len < 100 && memcmp(packet->payload, "<<>>", 14) == 0) { NDPI_LOG(NDPI_PROTOCOL_CHECKMK, ndpi_struct, NDPI_LOG_DEBUG, "Check_MK: Flow detected.\n"); ndpi_int_checkmk_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_CHECKMK, ndpi_struct, NDPI_LOG_DEBUG, "Check_MK excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CHECKMK); } void init_checkmk_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("CHECKMK", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_CHECKMK, ndpi_search_checkmk, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ciscovpn.c000066400000000000000000000051411321103654100175150ustar00rootroot00000000000000/* * ciscovpn.c * Copyright (C) 2013 by Remy Mudingay * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_CISCOVPN static void ndpi_int_ciscovpn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CISCOVPN, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_ciscovpn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t udport = 0, usport = 0; u_int16_t tdport = 0, tsport = 0; NDPI_LOG(NDPI_PROTOCOL_CISCOVPN, ndpi_struct, NDPI_LOG_DEBUG, "search CISCOVPN.\n"); if(packet->tcp != NULL) { tsport = ntohs(packet->tcp->source), tdport = ntohs(packet->tcp->dest); NDPI_LOG(NDPI_PROTOCOL_CISCOVPN, ndpi_struct, NDPI_LOG_DEBUG, "calculated CISCOVPN over tcp ports.\n"); } if(packet->udp != NULL) { usport = ntohs(packet->udp->source), udport = ntohs(packet->udp->dest); NDPI_LOG(NDPI_PROTOCOL_CISCOVPN, ndpi_struct, NDPI_LOG_DEBUG, "calculated CISCOVPN over udp ports.\n"); } if((tdport == 10000 && tsport == 10000) || ((tsport == 443 || tdport == 443) && (packet->payload[0] == 0x17 && packet->payload[1] == 0x01 && packet->payload[2] == 0x00 && packet->payload[3] == 0x00) ) ) { /* This is a good query 17010000*/ NDPI_LOG(NDPI_PROTOCOL_CISCOVPN, ndpi_struct, NDPI_LOG_DEBUG, "found CISCOVPN.\n"); ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); } else if( ( (usport == 10000 && udport == 10000) && (packet->payload[0] == 0xfe && packet->payload[1] == 0x57 && packet->payload[2] == 0x7e && packet->payload[3] == 0x2b) ) ) { /* This is a good query fe577e2b */ NDPI_LOG(NDPI_PROTOCOL_CISCOVPN, ndpi_struct, NDPI_LOG_DEBUG, "found CISCOVPN.\n"); ndpi_int_ciscovpn_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_CISCOVPN, ndpi_struct, NDPI_LOG_DEBUG, "exclude CISCOVPN.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CISCOVPN); } } void init_ciscovpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("CiscoVPN", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_CISCOVPN, ndpi_search_ciscovpn, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/citrix.c000066400000000000000000000065051321103654100172000ustar00rootroot00000000000000/* * citrix.c * * Copyright (C) 2012-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_CITRIX /* ************************************ */ static void ndpi_check_citrix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if(packet->tcp != NULL) { flow->l4.tcp.citrix_packet_id++; if((flow->l4.tcp.citrix_packet_id == 3) /* We have seen the 3-way handshake */ && flow->l4.tcp.seen_syn && flow->l4.tcp.seen_syn_ack && flow->l4.tcp.seen_ack) { if(payload_len == 6) { char citrix_header[] = { 0x07, 0x07, 0x49, 0x43, 0x41, 0x00 }; if(memcmp(packet->payload, citrix_header, sizeof(citrix_header)) == 0) { NDPI_LOG(NDPI_PROTOCOL_CITRIX, ndpi_struct, NDPI_LOG_DEBUG, "Found citrix.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CITRIX, NDPI_PROTOCOL_UNKNOWN); } return; } else if(payload_len > 4) { char citrix_header[] = { 0x1a, 0x43, 0x47, 0x50, 0x2f, 0x30, 0x31 }; if((memcmp(packet->payload, citrix_header, sizeof(citrix_header)) == 0) || (ndpi_strnstr((const char *)packet->payload, "Citrix.TcpProxyService", payload_len) != NULL)) { NDPI_LOG(NDPI_PROTOCOL_CITRIX, ndpi_struct, NDPI_LOG_DEBUG, "Found citrix.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CITRIX, NDPI_PROTOCOL_UNKNOWN); } return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CITRIX); } else if(flow->l4.tcp.citrix_packet_id > 3) NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CITRIX); return; } } void ndpi_search_citrix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_CITRIX, ndpi_struct, NDPI_LOG_DEBUG, "citrix detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_CITRIX) ndpi_check_citrix(ndpi_struct, flow); } void init_citrix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Citrix", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_CITRIX, ndpi_search_citrix, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/coap.c000066400000000000000000000113721321103654100166160ustar00rootroot00000000000000/* * coap.c * * Copyright (C) 2016 Sorin Zamfir * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_COAP #define CON 0 #define NO_CON 1 #define ACK 2 #define RST 3 struct ndpi_coap_hdr { #if defined(__BIG_ENDIAN__) u_int8_t version:2, type:2, tkl:4; #elif defined(__LITTLE_ENDIAN__) u_int8_t tkl:4, type:2, version:2; #endif u_int8_t code; u_int16_t message_id; //if needed, remember to convert in host number }; /** VALUE OF -CODE- FIELD [0] = "Empty", [1] = "GET", [2] = "POST", [3] = "PUT", [4] = "DELETE", [65] = "2.01 Created", [66] = "2.02 Deleted", [67] = "2.03 Valid", [68] = "2.04 Changed", [69] = "2.05 Content", [128] = "4.00 Bad Request", [129] = "4.01 Unauthorized", [130] = "4.02 Bad Option", [131] = "4.03 Forbidden", [132] = "4.04 Not Found", [133] = "4.05 Method Not Allowed", [134] = "4.06 Not Acceptable", [140] = "4.12 Precondition Failed", [141] = "4.13 Request Entity Too Large", [143] = "4.15 Unsupported Content-Format", [160] = "5.00 Internal Server Error", [161] = "5.01 Not Implemented", [162] = "5.02 Bad Gateway", [163] = "5.03 Service Unavailable", [164] = "5.04 Gateway Timeout", [165] = "5.05 Proxying Not Supported" **/ /** * Entry point when protocol is identified. */ static void ndpi_int_coap_add_connection (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_COAP,NDPI_PROTOCOL_UNKNOWN); } /** * Check if the default port is acceptable * * UDP Port 5683 (mandatory) * UDP Ports 61616-61631 compressed 6lowPAN */ static int isCoAPport(u_int16_t port) { if((port == 5683) || ((port >= 61616) && (port <= 61631))) return(1); else return(0); } /** * Dissector function that searches CoAP headers */ void ndpi_search_coap (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_coap_hdr * h = (struct ndpi_coap_hdr*) packet->payload; if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { return; } // search for udp packet if(packet->udp != NULL) { u_int16_t s_port = ntohs(flow->packet.udp->source); u_int16_t d_port = ntohs(flow->packet.udp->dest); if((!isCoAPport(s_port) && !isCoAPport(d_port)) || (packet->payload_packet_len < 4) // header too short ) { NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "excluding Coap\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP); return; } NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "calculating coap over udp.\n"); // check values in header if(h->version == 1) { if(h->type == CON || h->type == NO_CON || h->type == ACK || h->type == RST ) { if(h->tkl == 0 || h->tkl < 8) { if((h->code >= 0 && h->code <= 5) || (h->code >= 65 && h->code <= 69) || (h->code >= 128 && h->code <= 134) || (h->code >= 140 && h->code <= 143) || (h->code >= 160 && h->code <= 165)) { NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Coap found...\n"); ndpi_int_coap_add_connection(ndpi_struct,flow); return; } } } } } NDPI_LOG(NDPI_PROTOCOL_COAP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Coap ...\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COAP); return; } /** * Entry point for the ndpi library */ void init_coap_dissector (struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection ("COAP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_COAP, ndpi_search_coap, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id +=1; } #endif // NDPI_PROTOCOL_COAP nDPI-2.2/src/lib/protocols/collectd.c000066400000000000000000000033431321103654100174640ustar00rootroot00000000000000/* * collectd.c * * Copyright (C) 2014 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_COLLECTD void ndpi_search_collectd(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int len = 0; NDPI_LOG(NDPI_PROTOCOL_COLLECTD, ndpi_struct, NDPI_LOG_DEBUG, "search collectd.\n"); if (packet->udp == NULL) return; while(len < packet->payload_packet_len) { // u_int16_t elem_type = ntohs(*((u_int16_t*)&packet->payload[len])); u_int16_t elem_len = ntohs(*((u_int16_t*)&packet->payload[len+2])); if (elem_len == 0) break; len += elem_len; } if(len == packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_COLLECTD, ndpi_struct, NDPI_LOG_DEBUG, "found COLLECTD.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_COLLECTD, NDPI_PROTOCOL_UNKNOWN); } else { NDPI_LOG(NDPI_PROTOCOL_COLLECTD, ndpi_struct, NDPI_LOG_DEBUG, "exclude COLLECTD.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_COLLECTD); } } #endif nDPI-2.2/src/lib/protocols/corba.c000066400000000000000000000044731321103654100167660ustar00rootroot00000000000000/* * corba.c * * Copyright (C) 2013 Remy Mudingay * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_CORBA static void ndpi_int_corba_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CORBA, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_corba(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_CORBA, ndpi_struct, NDPI_LOG_DEBUG, "search for CORBA.\n"); if(packet->tcp != NULL) { NDPI_LOG(NDPI_PROTOCOL_CORBA, ndpi_struct, NDPI_LOG_DEBUG, "calculating CORBA over tcp.\n"); /* Corba General Inter-ORB Protocol -> GIOP */ if ((packet->payload_packet_len >= 24 && packet->payload_packet_len <= 144) && memcmp(packet->payload, "GIOP", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_CORBA, ndpi_struct, NDPI_LOG_DEBUG, "found corba.\n"); ndpi_int_corba_add_connection(ndpi_struct, flow); } } else { NDPI_LOG(NDPI_PROTOCOL_CORBA, ndpi_struct, NDPI_LOG_DEBUG, "exclude CORBA.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CORBA); } } void init_corba_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Corba", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_CORBA, ndpi_search_corba, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/crossfire.c000066400000000000000000000070021321103654100176660ustar00rootroot00000000000000/* * crossfire.c * * Copyright (C) 2012-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* include files */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_CROSSFIRE static void ndpi_int_crossfire_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CROSSFIRE, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_crossfire_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_CROSSFIRE, ndpi_struct, NDPI_LOG_DEBUG, "search crossfire.\n"); if (packet->udp != 0) { if (packet->payload_packet_len == 25 && get_u_int32_t(packet->payload, 0) == ntohl(0xc7d91999) && get_u_int16_t(packet->payload, 4) == ntohs(0x0200) && get_u_int16_t(packet->payload, 22) == ntohs(0x7d00) ) { NDPI_LOG(NDPI_PROTOCOL_CROSSFIRE, ndpi_struct, NDPI_LOG_DEBUG, "Crossfire: found udp packet.\n"); ndpi_int_crossfire_add_connection(ndpi_struct, flow); return; } } else if (packet->tcp != 0) { if (packet->payload_packet_len > 4 && memcmp(packet->payload, "GET /", 5) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->parsed_lines == 8 && (packet->line[0].ptr != NULL && packet->line[0].len >= 30 && (memcmp(&packet->payload[5], "notice/login_big", 16) == 0 || memcmp(&packet->payload[5], "notice/login_small", 18) == 0)) && memcmp(&packet->payload[packet->line[0].len - 19], "/index.asp HTTP/1.", 18) == 0 && (packet->host_line.ptr != NULL && packet->host_line.len >= 13 && (memcmp(packet->host_line.ptr, "crossfire", 9) == 0 || memcmp(packet->host_line.ptr, "www.crossfire", 13) == 0)) ) { NDPI_LOG(NDPI_PROTOCOL_CROSSFIRE, ndpi_struct, NDPI_LOG_DEBUG, "Crossfire: found HTTP request.\n"); ndpi_int_crossfire_add_connection(ndpi_struct, flow); return; } } } NDPI_LOG(NDPI_PROTOCOL_CROSSFIRE, ndpi_struct, NDPI_LOG_DEBUG, "exclude crossfire.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CROSSFIRE); } void init_crossfire_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Crossfire", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_CROSSFIRE, ndpi_search_crossfire_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/csgo.c000066400000000000000000000123221321103654100166230ustar00rootroot00000000000000/* * csgo.c * * Copyright (C) 2016-2017 Vitaly Lavrov * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_CSGO void ndpi_search_csgo(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { struct ndpi_packet_struct* packet = &flow->packet; if (packet->udp != NULL) { uint32_t w = htonl(get_u_int32_t(packet->payload, 0)); NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "CSGO: word %08x\n", w); if (!flow->csgo_state && packet->payload_packet_len == 23 && w == 0xfffffffful) { if (!memcmp(packet->payload + 5, "connect0x", 9)) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo connect0x.\n"); flow->csgo_state++; memcpy(flow->csgo_strid, packet->payload + 5, 18); return; } } if (flow->csgo_state == 1 && packet->payload_packet_len >= 42 && w == 0xfffffffful) { if (!memcmp(packet->payload + 24, flow->csgo_strid, 18)) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo connect0x reply.\n"); flow->csgo_state++; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN); return; } } if (packet->payload_packet_len == 8 && ( w == 0x3a180000 || w == 0x39180000) ) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo udp 8b.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN); return; } if (packet->payload_packet_len >= 36 && w == 0x56533031ul) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo udp.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN); return; } if (packet->payload_packet_len >= 36 && w == 0x01007364) { uint32_t w2 = htonl(get_u_int32_t(packet->payload, 4)); if (w2 == 0x70696e67) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo udp ping.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN); return; } } if (flow->csgo_s2 < 3 && (w & 0xffff0000ul) == 0x0d1d0000) { uint32_t w2 = get_u_int32_t(packet->payload, 2); if (packet->payload_packet_len == 13) { if (!flow->csgo_s2) { flow->csgo_id2 = w2; flow->csgo_s2 = 1; NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo udp 0d1d step1.\n"); return; } if (flow->csgo_s2 == 1 && flow->csgo_id2 == w2) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo udp 0d1d step1 DUP.\n"); return; } flow->csgo_s2 = 3; return; } if (packet->payload_packet_len == 15) { if (flow->csgo_s2 == 1 && flow->csgo_id2 == w2) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo udp 0d1d.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN); return; } } flow->csgo_s2 = 3; } if (packet->payload_packet_len >= 140 && (w == 0x02124c6c || w == 0x02125c6c) && !memcmp(&packet->payload[3], "lta\000mob\000tpc\000bhj\000bxd\000tae\000urg\000gkh\000", 32)) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo dictionary udp.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN); return; } if (packet->payload_packet_len >= 33 && packet->iph && packet->iph->daddr == 0xffffffff && !memcmp(&packet->payload[17], "LanSearch", 9)) { NDPI_LOG(NDPI_PROTOCOL_CSGO, ndpi_struct, NDPI_LOG_DEBUG, "Found csgo LanSearch udp.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_CSGO, NDPI_PROTOCOL_UNKNOWN); return; } } if (flow->packet_counter > 20) NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_CSGO); } void init_csgo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("CSGO", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_CSGO, ndpi_search_csgo, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/dcerpc.c000066400000000000000000000044531321103654100171360ustar00rootroot00000000000000/* * dcerpc.c * * Copyright (C) 2011-13 by ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_DCERPC static void ndpi_int_dcerpc_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DCERPC, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_dcerpc(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if((packet->tcp != NULL) && (packet->payload_packet_len >= 64) && (packet->payload[0] == 0x05) /* version 5 */ && (packet->payload[2] < 16) /* Packet type */ && (((packet->payload[9]<<8) | packet->payload[8]) == packet->payload_packet_len) /* Packet Length */ ) { NDPI_LOG(NDPI_PROTOCOL_DCERPC, ndpi_struct, NDPI_LOG_DEBUG, "DCERPC match\n"); ndpi_int_dcerpc_add_connection(ndpi_struct, flow); return; } if(packet->payload_packet_len>1){ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DCERPC); } } void init_dcerpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("DCE_RPC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DCERPC, ndpi_search_dcerpc, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/dhcp.c000066400000000000000000000111111321103654100166010ustar00rootroot00000000000000/* * dhcp.c * * Copyright (C) 2016 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_DHCP /* freeradius/src/lib/dhcp.c */ #define DHCP_CHADDR_LEN 16 #define DHCP_SNAME_LEN 64 #define DHCP_FILE_LEN 128 #define DHCP_VEND_LEN 308 #define DHCP_OPTION_MAGIC_NUMBER 0x63825363 typedef struct { uint8_t msgType; uint8_t htype; uint8_t hlen; uint8_t hops; uint32_t xid;/* 4 */ uint16_t secs;/* 8 */ uint16_t flags; uint32_t ciaddr;/* 12 */ uint32_t yiaddr;/* 16 */ uint32_t siaddr;/* 20 */ uint32_t giaddr;/* 24 */ uint8_t chaddr[DHCP_CHADDR_LEN]; /* 28 */ uint8_t sname[DHCP_SNAME_LEN]; /* 44 */ uint8_t file[DHCP_FILE_LEN]; /* 108 */ uint32_t magic; /* 236 */ uint8_t options[DHCP_VEND_LEN]; } dhcp_packet_t; static void ndpi_int_dhcp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DHCP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_dhcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; /* this detection also works for asymmetric dhcp traffic */ /*check standard DHCP 0.0.0.0:68 -> 255.255.255.255:67 */ if(packet->udp) { dhcp_packet_t *dhcp = (dhcp_packet_t*)packet->payload; if((packet->payload_packet_len >= 244) && (packet->udp->source == htons(67) || packet->udp->source == htons(68)) && (packet->udp->dest == htons(67) || packet->udp->dest == htons(68)) && (dhcp->magic == htonl(DHCP_OPTION_MAGIC_NUMBER))) { int i = 0, foundValidMsgType = 0; while(i < DHCP_VEND_LEN) { u_int8_t id = dhcp->options[i]; if(id == 0xFF) break; else { u_int8_t len = dhcp->options[i+1]; if(len == 0) break; #ifdef DHCP_DEBUG printf("[DHCP] Id=%d [len=%d]\n", id, len); #endif if(id == 53 /* DHCP Message Type */) { u_int8_t msg_type = dhcp->options[i+2]; if(msg_type <= 8) foundValidMsgType = 1; } else if(id == 55 /* Parameter Request List / Fingerprint */) { u_int idx, offset = 0, hex_len = ndpi_min(len * 2, sizeof(flow->protos.dhcp.fingerprint)); for(idx=0; idxprotos.dhcp.fingerprint[offset], sizeof(flow->protos.dhcp.fingerprint)-offset-1, "%02X", dhcp->options[i+2+idx] & 0xFF); offset += 2; } } else if(id == 60 /* Class Identifier */) { char *name = (char*)&dhcp->options[i+2]; int j = 0; j = ndpi_min(len, sizeof(flow->protos.dhcp.class_ident)-1); strncpy((char*)flow->protos.dhcp.class_ident, name, j); flow->protos.dhcp.class_ident[j] = '\0'; } else if(id == 12 /* Host Name */) { char *name = (char*)&dhcp->options[i+2]; int j = 0; #ifdef DHCP_DEBUG printf("[DHCP] "); while(j < len) { printf("%c", name[j]); j++; } printf("\n"); #endif j = ndpi_min(len, sizeof(flow->host_server_name)-1); strncpy((char*)flow->host_server_name, name, j); flow->host_server_name[j] = '\0'; } i += len + 2; } } //get_u_int16_t(packet->payload, 240) == htons(0x3501)) { if(foundValidMsgType) { NDPI_LOG(NDPI_PROTOCOL_DHCP, ndpi_struct, NDPI_LOG_DEBUG, "DHCP found\n"); ndpi_int_dhcp_add_connection(ndpi_struct, flow); } return; } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DHCP); } void init_dhcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("DHCP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DHCP, ndpi_search_dhcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/dhcpv6.c000066400000000000000000000047161321103654100170720ustar00rootroot00000000000000/* * dhcpv6.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* include files */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_DHCPV6 static void ndpi_int_dhcpv6_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DHCPV6, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_dhcpv6_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len >= 4 && (packet->udp->source == htons(546) || packet->udp->source == htons(547)) && (packet->udp->dest == htons(546) || packet->udp->dest == htons(547)) && packet->payload[0] >= 1 && packet->payload[0] <= 13) { NDPI_LOG(NDPI_PROTOCOL_DHCPV6, ndpi_struct, NDPI_LOG_DEBUG, "DHCPv6 detected.\n"); ndpi_int_dhcpv6_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_DHCPV6, ndpi_struct, NDPI_LOG_DEBUG, "DHCPv6 excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DHCPV6); } void init_dhcpv6_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("DHCPV6", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DHCPV6, ndpi_search_dhcpv6_udp, NDPI_SELECTION_BITMASK_PROTOCOL_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/directconnect.c000066400000000000000000000415271321103654100205250ustar00rootroot00000000000000/* * directconnect.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_DIRECTCONNECT //#define NDPI_DEBUG_DIRECTCONNECT //#define NDPI_DIRECTCONNECT_PORT_DEBUG //#define NDPI_DEBUG_DIRECTCONNECT_CONN #define DIRECT_CONNECT_TYPE_HUB 0 #define DIRECT_CONNECT_TYPE_PEER 1 #define DIRECT_CONNECT_ADC_PEER 2 static u_int32_t skip_unknown_headers(const u_int8_t * payload, u_int32_t payload_len, u_int32_t pos) { u_int32_t i = pos; while (i < payload_len && payload[i] != 0x0a) i++; i++; return i; } static u_int16_t parse_binf_message(struct ndpi_detection_module_struct *ndpi_struct, const u_int8_t * payload, int payload_len) { u_int32_t i = 4; u_int16_t bytes_read = 0; u_int16_t ssl_port = 0; while (i < payload_len) { i = skip_unknown_headers(payload, payload_len, i); if ((i + 30) < payload_len) { if (memcmp(&payload[i], "DCTM", 4) == 0) { if (memcmp(&payload[i + 15], "ADCS", 4) == 0) { ssl_port = ntohs_ndpi_bytestream_to_number(&payload[i + 25], 5, &bytes_read); NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "directconnect ssl port parsed %d", ssl_port); } } } else { break; } } return ssl_port; } static void ndpi_int_directconnect_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const u_int8_t connection_type) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN); if (src != NULL) { src->directconnect_last_safe_access_time = packet->tick_timestamp; if (connection_type == DIRECT_CONNECT_TYPE_PEER) { if (packet->tcp != NULL && flow->setup_packet_direction != packet->packet_direction && src->detected_directconnect_port == 0) { src->detected_directconnect_port = packet->tcp->source; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "directconnect tcp PORT %u for src\n", ntohs(src->detected_directconnect_port)); } if (packet->udp != NULL && src->detected_directconnect_udp_port == 0) { src->detected_directconnect_udp_port = packet->udp->source; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "directconnect udp PORT %u for src\n", ntohs(src->detected_directconnect_port)); } } } if (dst != NULL) { dst->directconnect_last_safe_access_time = packet->tick_timestamp; if (connection_type == DIRECT_CONNECT_TYPE_PEER) { if (packet->tcp != NULL && flow->setup_packet_direction == packet->packet_direction && dst->detected_directconnect_port == 0) { /* DST PORT MARKING CAN LEAD TO PORT MISSDETECTIONS * seen at large customer http servers, where someone has send faked DC tcp packets * to the server */ /* dst->detected_directconnect_port = packet->tcp->dest; NDPI_LOG (NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "directconnect tcp PORT %u for dst\n", ntohs (dst->detected_directconnect_port)); */ } } } } static void ndpi_search_directconnect_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_DIRECTCONNECT) { if (packet->payload_packet_len >= 40 && memcmp(&packet->payload[0], "BINF", 4) == 0) { u_int16_t ssl_port = 0; ssl_port = parse_binf_message(ndpi_struct, &packet->payload[4], packet->payload_packet_len - 4); if (dst != NULL && ssl_port) { dst->detected_directconnect_ssl_port = ssl_port; } if (src != NULL && ssl_port) { src->detected_directconnect_ssl_port = ssl_port; } } if ((packet->payload_packet_len >= 38 && packet->payload_packet_len <= 42) && memcmp(&packet->payload[0], "DCTM", 4) == 0 && memcmp(&packet->payload[15], "ADCS", 4) == 0) { u_int16_t bytes_read = 0; if (dst != NULL) { dst->detected_directconnect_ssl_port = ntohs_ndpi_bytestream_to_number(&packet->payload[25], 5, &bytes_read); NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "directconnect ssl port parsed %d", ntohs(dst->detected_directconnect_ssl_port)); } if (src != NULL) { src->detected_directconnect_ssl_port = ntohs_ndpi_bytestream_to_number(&packet->payload[25], 5, &bytes_read); NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "directconnect ssl port parsed %d", ntohs(src->detected_directconnect_ssl_port)); } } return; } if (src != NULL) { if (src->detected_directconnect_port == packet->tcp->source) { if ((u_int32_t) (packet->tick_timestamp - src->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) { ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN); src->directconnect_last_safe_access_time = packet->tick_timestamp; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(src->detected_directconnect_port)); return; } else { src->detected_directconnect_port = 0; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "resetting src port due to timeout"); return; } } if (src->detected_directconnect_ssl_port == packet->tcp->dest) { if ((u_int32_t) (packet->tick_timestamp - src->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) { ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN); src->directconnect_last_safe_access_time = packet->tick_timestamp; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(src->detected_directconnect_ssl_port)); return; } else { src->detected_directconnect_ssl_port = 0; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "resetting src port due to timeout"); return; } } } if (dst != NULL) { if (dst->detected_directconnect_port == packet->tcp->dest) { if ((u_int32_t) (packet->tick_timestamp - dst->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN); dst->directconnect_last_safe_access_time = packet->tick_timestamp; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(dst->detected_directconnect_port)); return; } else { dst->detected_directconnect_port = 0; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "resetting dst port due to timeout"); return; } } if (dst->detected_directconnect_ssl_port == packet->tcp->dest) { if ((u_int32_t) (packet->tick_timestamp - dst->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN); dst->directconnect_last_safe_access_time = packet->tick_timestamp; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "marking using dc port\n %d", ntohs(dst->detected_directconnect_ssl_port)); return; } else { dst->detected_directconnect_ssl_port = 0; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "resetting dst port due to timeout"); return; } } } if (flow->directconnect_stage == 0) { if (packet->payload_packet_len > 6) { if (packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|' && (memcmp(&packet->payload[1], "Lock ", 5) == 0)) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "maybe first dc connect to hub detected\n"); flow->directconnect_stage = 1; return; } if (packet->payload_packet_len > 7 && packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|' && (memcmp(&packet->payload[1], "MyNick ", 7) == 0)) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "maybe first dc connect between peers detected\n"); flow->directconnect_stage = 2; return; } } if (packet->payload_packet_len >= 11) { /* did not see this pattern in any trace */ if (memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0 || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "found directconnect HSUP ADBAS0 E\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); return; /* did not see this pattern in any trace */ } else if (memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 || memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "found directconnect CSUP ADBAS0 E\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER); return; } } } else if (flow->directconnect_stage == 1) { if (packet->payload_packet_len >= 11) { /* did not see this pattern in any trace */ if (memcmp(&packet->payload[0], "HSUP ADBAS0", 11) == 0 || memcmp(&packet->payload[0], "HSUP ADBASE", 11) == 0) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "found directconnect HSUP ADBAS E in second packet\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); return; /* did not see this pattern in any trace */ } else if (memcmp(&packet->payload[0], "CSUP ADBAS0", 11) == 0 || memcmp(&packet->payload[0], "CSUP ADBASE", 11) == 0) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "found directconnect HSUP ADBAS0 E in second packet\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_ADC_PEER); return; } } /* get client hello answer or server message */ if (packet->payload_packet_len > 6) { if ((packet->payload[0] == '$' || packet->payload[0] == '<') && packet->payload[packet->payload_packet_len - 1] == '|') { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "second dc detected\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_HUB); return; } else { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "second dc not detected\n"); } } } else if (flow->directconnect_stage == 2) { /* get client hello answer or server message */ if (packet->payload_packet_len > 6) { if (packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|') { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "second dc between peers detected\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER); return; } else { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "second dc between peers not detected\n"); } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT); } static void ndpi_search_directconnect_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; int pos, count = 0; if (dst != NULL && dst->detected_directconnect_udp_port == packet->udp->dest) { if ((u_int32_t) (packet->tick_timestamp - dst->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECTCONNECT, NDPI_PROTOCOL_UNKNOWN); dst->directconnect_last_safe_access_time = packet->tick_timestamp; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "marking using dc udp port\n %d", ntohs(dst->detected_directconnect_udp_port)); return; } else { dst->detected_directconnect_udp_port = 0; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "resetting dst udp port due to timeout"); return; } } if (packet->payload_packet_len > 58) { if (src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT)) { if (packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|' && memcmp(&packet->payload[1], "SR ", 3) == 0) { pos = packet->payload_packet_len - 2; if (packet->payload[pos] == ')') { while (pos > 0 && packet->payload[pos] != '(' && count < 21) { pos--; count++; } if (packet->payload[pos] == '(') { pos = pos - 44; if (pos > 2 && memcmp(&packet->payload[pos], "TTH:", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "dc udp detected\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER); return; } } } flow->directconnect_stage++; if (flow->directconnect_stage < 3) { return; } } } if (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT)) { if (packet->payload[0] == '$' && packet->payload[packet->payload_packet_len - 1] == '|' && memcmp(&packet->payload[1], "SR ", 3) == 0) { pos = packet->payload_packet_len - 2; if (packet->payload[pos] == ')') { while (pos > 0 && packet->payload[pos] != '(' && count < 21) { pos--; count++; } if (packet->payload[pos] == '(') { pos = pos - 44; if (pos > 2 && memcmp(&packet->payload[pos], "TTH:", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "dc udp detected\n"); ndpi_int_directconnect_add_connection(ndpi_struct, flow, DIRECT_CONNECT_TYPE_PEER); return; } } } flow->directconnect_stage++; if (flow->directconnect_stage < 3) return; } } } NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "excluded at stage %d \n", flow->directconnect_stage); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DIRECTCONNECT); } void ndpi_search_directconnect(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_DIRECTCONNECT) { if (src != NULL && ((u_int32_t) (packet->tick_timestamp - src->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout)) { src->directconnect_last_safe_access_time = packet->tick_timestamp; } else if (dst != NULL && ((u_int32_t) (packet->tick_timestamp - dst->directconnect_last_safe_access_time) < ndpi_struct->directconnect_connection_ip_tick_timeout)) { dst->directconnect_last_safe_access_time = packet->tick_timestamp; } else { packet->detected_protocol_stack[0] = NDPI_PROTOCOL_UNKNOWN; NDPI_LOG(NDPI_PROTOCOL_DIRECTCONNECT, ndpi_struct, NDPI_LOG_DEBUG, "directconnect: skipping as unknown due to timeout\n"); } return; } if (packet->tcp != NULL) { ndpi_search_directconnect_tcp(ndpi_struct, flow); } else if (packet->udp != NULL) { ndpi_search_directconnect_udp(ndpi_struct, flow); } } void init_directconnect_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("DirectConnect", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DIRECTCONNECT, ndpi_search_directconnect, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/directdownloadlink.c000066400000000000000000001107221321103654100215530ustar00rootroot00000000000000/* * directdownloadlink.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-14svn - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK #ifdef NDPI_DEBUG_DIRECT_DOWNLOAD_LINK //#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_NOTHING_FOUND //#define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_PACKET_TOO_SMALL #define NDPI_DEBUG_DIRECT_DOWNLOAD_LINK_IP #endif static void ndpi_int_direct_download_link_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, NDPI_PROTOCOL_UNKNOWN); flow->l4.tcp.ddlink_server_direction = packet->packet_direction; } /* return 0 if nothing has been detected return 1 if it is a megaupload packet */ u_int8_t search_ddl_domains(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int16_t filename_start = 0; u_int8_t i = 1; u_int16_t host_line_len_without_port; if (packet->payload_packet_len < 100) { NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: Packet too small.\n"); goto end_ddl_nothing_found; } if (memcmp(packet->payload, "POST ", 5) == 0) { filename_start = 5; // POST NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: POST FOUND\n"); } else if (memcmp(packet->payload, "GET ", 4) == 0) { filename_start = 4; // GET NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: GET FOUND\n"); } else { goto end_ddl_nothing_found; } // parse packet ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->host_line.ptr == NULL) { NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: NO HOST FOUND\n"); goto end_ddl_nothing_found; } NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: Host: found\n"); if (packet->line[0].len < 9 + filename_start || memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) != 0) { NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: PACKET NOT HTTP CONFORM.\nXXX%.*sXXX\n", 8, &packet->line[0].ptr[packet->line[0].len - 9]); goto end_ddl_nothing_found; } // BEGIN OF AUTOMATED CODE GENERATION // first see if we have ':port' at the end of the line host_line_len_without_port = packet->host_line.len; if (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] >= '0' && packet->host_line.ptr[packet->host_line.len - i] <= '9') { i = 2; while (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] >= '0' && packet->host_line.ptr[host_line_len_without_port - i] <= '9') { NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: number found\n"); i++; } if (host_line_len_without_port >= i && packet->host_line.ptr[host_line_len_without_port - i] == ':') { NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: ':' found\n"); host_line_len_without_port = host_line_len_without_port - i; } } // then start automated code generation if (host_line_len_without_port >= 0 + 4 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 4], ".com", 4) == 0) { if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'd') { if (host_line_len_without_port >= 5 + 6 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 6], "4share", 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "fileclou", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 5 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "uploa", 5) == 0) { if (host_line_len_without_port >= 10 + 6 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 6], "files-", 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 10 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "mega", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 10 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "rapid", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 10 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "turbo", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'o') { if (host_line_len_without_port >= 5 + 6 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 6], "badong", 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 6 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "fileh", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'g') { if (host_line_len_without_port >= 5 + 2 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 2], "in", 2) == 0) { if (host_line_len_without_port >= 7 + 4 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 4], "shar", 4) == 0) { if (host_line_len_without_port >= 11 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 11 - 4], "best", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 11 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 11 - 4 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 11 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 11 - 5], "quick", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 11 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 11 - 5 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 7 + 6 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 6], "upload", 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 7 - 6 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 7 - 6 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 5 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "sharebi", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 8], "bigfilez", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'e') { if (host_line_len_without_port >= 5 + 3 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 3], "fil", 3) == 0) { if (host_line_len_without_port >= 8 + 2 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 2], "mo", 2) == 0) { if (host_line_len_without_port >= 10 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "china", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 8 + 2 + 1 && (packet->host_line.ptr[host_line_len_without_port - 8 - 2 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 2 - 1] == '.')) { goto end_ddl_found; } } if (host_line_len_without_port >= 8 + 3 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 3], "hot", 3) == 0 && (packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 8 + 6 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 6], "keepmy", 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 8 - 6 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 6 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 8 + 1 && packet->host_line.ptr[host_line_len_without_port - 8 - 1] == 'e') { if (host_line_len_without_port >= 9 + 3 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 3], "sav", 3) == 0 && (packet->host_line.ptr[host_line_len_without_port - 9 - 3 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 9 - 3 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 9 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 5], "sendm", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 8 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 8], "sharebig", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 8 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 8 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 8 + 3 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 3], "up-", 3) == 0 && (packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 3 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 5 + 1 && packet->host_line.ptr[host_line_len_without_port - 5 - 1] == 'r') { if (host_line_len_without_port >= 6 + 3 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 3], "sha", 3) == 0) { if (host_line_len_without_port >= 9 + 1 && packet->host_line.ptr[host_line_len_without_port - 9 - 1] == '-') { if (host_line_len_without_port >= 10 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "easy", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 10 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "fast", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 10 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 4], "live", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 4 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 9 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "ftp2", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 9 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "gige", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 9 + 4 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 4], "mega", 4) == 0 && (packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 9 - 4 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 9 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 9 - 5], "rapid", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 9 - 5 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 6 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 7], "mediafi", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 6 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 6 - 7 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 5 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "gigasiz", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "sendspac", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "sharebe", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 11 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 11], "sharebigfli", 11) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "fileserv", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 's') { if (host_line_len_without_port >= 5 + 1 && packet->host_line.ptr[host_line_len_without_port - 5 - 1] == 'e') { if (host_line_len_without_port >= 6 + 10 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 10], "depositfil", 10) == 0 && (packet->host_line.ptr[host_line_len_without_port - 6 - 10 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 6 - 10 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 6 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 6 - 8], "megashar", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 6 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 6 - 8 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 5 + 10 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "fileupyour", 10) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 11 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 11], "filefactory", 11) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 11 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 11 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 't') { if (host_line_len_without_port >= 5 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "filefron", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 10 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "uploadingi", 10) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 11 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 11], "yourfilehos", 11) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 11 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'r') { if (host_line_len_without_port >= 5 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 8], "mytempdi", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 8 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 10 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 10], "uploadpowe", 10) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 10 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 9 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "mega.1280", 9) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 9 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "filesonic", 9) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 0 + 4 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 4], ".net", 4) == 0) { if (host_line_len_without_port >= 4 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "badongo", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'd') { if (host_line_len_without_port >= 5 + 3 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 3], "loa", 3) == 0) { if (host_line_len_without_port >= 8 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "fast-", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 8 + 2 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 2], "up", 2) == 0) { if (host_line_len_without_port >= 10 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 5], "file-", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 10 + 6 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 6], "simple", 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 6 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 10 + 3 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 10 - 3], "wii", 3) == 0 && (packet->host_line.ptr[host_line_len_without_port - 10 - 3 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 10 - 3 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 5 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 7], "filesen", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 7 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 4 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 5], "filer", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 9 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 9], "livedepot", 9) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 9 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 1 && packet->host_line.ptr[host_line_len_without_port - 4 - 1] == 'e') { if (host_line_len_without_port >= 5 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "mofil", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 17 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 17], "odsiebie.najlepsz", 17) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 17 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 17 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 5 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 5 - 5], "zshar", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 5 - 5 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'u') { if (host_line_len_without_port >= 1 + 6 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 6], "data.h", 6) == 0 && (packet->host_line.ptr[host_line_len_without_port - 1 - 6 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 1 - 6 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 1 + 2 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 2], ".r", 2) == 0) { if (host_line_len_without_port >= 3 + 10 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 10], "filearchiv", 10) == 0 && (packet->host_line.ptr[host_line_len_without_port - 3 - 10 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 3 - 10 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 3 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 8], "filepost", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 3 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 3 - 8 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 3 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 7], "ifolder", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 0 + 11 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 11], "filehost.tv", 11) == 0 && (packet->host_line.ptr[host_line_len_without_port - 0 - 11 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 0 - 11 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 0 + 3 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 3], ".to", 3) == 0) { if (host_line_len_without_port >= 3 + 1 && packet->host_line.ptr[host_line_len_without_port - 3 - 1] == 'e') { if (host_line_len_without_port >= 4 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "filesaf", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 8 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 8], "sharebas", 8) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 8 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 3 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 5], "files", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 3 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 3 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 3 + 1 && packet->host_line.ptr[host_line_len_without_port - 3 - 1] == 'd') { if (host_line_len_without_port >= 4 + 3 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 3], "loa", 3) == 0) { if (host_line_len_without_port >= 7 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 7 - 7], "file-up", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 7 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 7 - 7 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 4 + 3 + 1 && (packet->host_line.ptr[host_line_len_without_port - 4 - 3 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 3 - 1] == '.')) { goto end_ddl_found; } } if (host_line_len_without_port >= 4 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 4 - 7], "uploade", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 4 - 7 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'z') { if (host_line_len_without_port >= 1 + 14 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 14], "leteckaposta.c", 14) == 0 && (packet->host_line.ptr[host_line_len_without_port - 1 - 14 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 1 - 14 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 1 + 12 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 12], "yourfiles.bi", 12) == 0 && (packet->host_line.ptr[host_line_len_without_port - 1 - 12 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 1 - 12 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 0 + 1 && packet->host_line.ptr[host_line_len_without_port - 0 - 1] == 'n') { if (host_line_len_without_port >= 1 + 9 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 9], "netload.i", 9) == 0 && (packet->host_line.ptr[host_line_len_without_port - 1 - 9 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 1 - 9 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 1 + 2 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 1 - 2], ".v", 2) == 0) { if (host_line_len_without_port >= 3 + 7 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 7], "4shared", 7) == 0 && (packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 3 - 7 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 3 + 9 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 9], "megashare", 9) == 0 && (packet->host_line.ptr[host_line_len_without_port - 3 - 9 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 3 - 9 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 0 + 3 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 3], ".de", 3) == 0) { if (host_line_len_without_port >= 3 + 5 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 5], "share", 5) == 0) { if (host_line_len_without_port >= 8 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "rapid", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { goto end_ddl_found; } if (host_line_len_without_port >= 8 + 5 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 8 - 5], "ultra", 5) == 0 && (packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 8 - 5 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 3 + 15 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 3 - 15], "uploadyourfiles", 15) == 0 && (packet->host_line.ptr[host_line_len_without_port - 3 - 15 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 3 - 15 - 1] == '.')) { goto end_ddl_found; } goto end_ddl_nothing_found; } if (host_line_len_without_port >= 0 + 14 + 1 && memcmp((void *) &packet->host_line.ptr[host_line_len_without_port - 0 - 14], "speedshare.org", 14) == 0 && (packet->host_line.ptr[host_line_len_without_port - 0 - 14 - 1] == ' ' || packet->host_line.ptr[host_line_len_without_port - 0 - 14 - 1] == '.')) { goto end_ddl_found; } // END OF AUTOMATED CODE GENERATION /* This is the hard way. We do this in order to find the download of services when other domains are involved. This is not significant if ddl is blocked. --> then the link can not be started because the ads are not viewed. But when ddl is only limited then the download is the important part. */ end_ddl_nothing_found: NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "Nothing Found\n"); return 0; end_ddl_found: NDPI_LOG(NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_struct, NDPI_LOG_DEBUG, "DDL: DIRECT DOWNLOAD LINK FOUND\n"); ndpi_int_direct_download_link_add_connection(ndpi_struct, flow); return 1; } void ndpi_search_direct_download_link_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* struct ndpi_id_struct *src=ndpi_struct->src; */ /* struct ndpi_id_struct *dst=ndpi_struct->dst; */ /* do not detect again if it is already ddl */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK) { if (search_ddl_domains(ndpi_struct, flow) != 0) { return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK); } } void init_directdownloadlink_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Direct_Download_Link", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DIRECT_DOWNLOAD_LINK, ndpi_search_direct_download_link_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/dns.c000066400000000000000000000173331321103654100164630ustar00rootroot00000000000000/* * dns.c * * Copyright (C) 2012-16 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_DNS #define FLAGS_MASK 0x8000 /* #define DNS_DEBUG 1 */ /* *********************************************** */ static u_int16_t get16(int *i, const u_int8_t *payload) { u_int16_t v = *(u_int16_t*)&payload[*i]; (*i) += 2; return(ntohs(v)); } /* *********************************************** */ static u_int getNameLength(u_int i, const u_int8_t *payload, u_int payloadLen) { if(payload[i] == 0x00) return(1); else if(payload[i] == 0xC0) return(2); else { u_int8_t len = payload[i]; u_int8_t off = len + 1; if(off == 0) /* Bad packet */ return(0); else return(off + getNameLength(i+off, payload, payloadLen)); } } /* *********************************************** */ void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { int x; u_int8_t is_query; u_int16_t s_port = 0, d_port = 0; NDPI_LOG(NDPI_PROTOCOL_DNS, ndpi_struct, NDPI_LOG_DEBUG, "search DNS.\n"); if(flow->packet.udp != NULL) { s_port = ntohs(flow->packet.udp->source); d_port = ntohs(flow->packet.udp->dest); x = 0; } else if(flow->packet.tcp != NULL) /* pkt size > 512 bytes */ { s_port = ntohs(flow->packet.tcp->source); d_port = ntohs(flow->packet.tcp->dest); x = 2; } else { NDPI_LOG(NDPI_PROTOCOL_DNS, ndpi_struct, NDPI_LOG_DEBUG, "exclude DNS.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DNS); } if((s_port == 53 || d_port == 53 || d_port == 5355) && (flow->packet.payload_packet_len > sizeof(struct ndpi_dns_packet_header)+x)) { struct ndpi_dns_packet_header dns_header; int invalid = 0; memcpy(&dns_header, (struct ndpi_dns_packet_header*) &flow->packet.payload[x], sizeof(struct ndpi_dns_packet_header)); dns_header.tr_id = ntohs(dns_header.tr_id); dns_header.flags = ntohs(dns_header.flags); dns_header.num_queries = ntohs(dns_header.num_queries); dns_header.num_answers = ntohs(dns_header.num_answers); dns_header.authority_rrs = ntohs(dns_header.authority_rrs); dns_header.additional_rrs = ntohs(dns_header.additional_rrs); x += sizeof(struct ndpi_dns_packet_header); /* 0x0000 QUERY */ if((dns_header.flags & FLAGS_MASK) == 0x0000) is_query = 1; /* 0x8000 RESPONSE */ else if((dns_header.flags & FLAGS_MASK) == 0x8000) is_query = 0; else invalid = 1; if(!invalid) { if(is_query) { /* DNS Request */ if((dns_header.num_queries > 0) && (dns_header.num_queries <= NDPI_MAX_DNS_REQUESTS) && (((dns_header.flags & 0x2800) == 0x2800 /* Dynamic DNS Update */) || ((dns_header.num_answers == 0) && (dns_header.authority_rrs == 0)))) { /* This is a good query */ if(dns_header.num_queries > 0) { while(x < flow->packet.payload_packet_len) { if(flow->packet.payload[x] == '\0') { x++; flow->protos.dns.query_type = get16(&x, flow->packet.payload); #ifdef DNS_DEBUG printf("[%s:%d] query_type=%2d\n", __FILE__, __LINE__, flow->protos.dns.query_type); #endif break; } else x++; } } } else invalid = 1; } else { /* DNS Reply */ flow->protos.dns.reply_code = dns_header.flags & 0x0F; if((dns_header.num_queries > 0) && (dns_header.num_queries <= NDPI_MAX_DNS_REQUESTS) /* Don't assume that num_queries must be zero */ && (((dns_header.num_answers > 0) && (dns_header.num_answers <= NDPI_MAX_DNS_REQUESTS)) || ((dns_header.authority_rrs > 0) && (dns_header.authority_rrs <= NDPI_MAX_DNS_REQUESTS)) || ((dns_header.additional_rrs > 0) && (dns_header.additional_rrs <= NDPI_MAX_DNS_REQUESTS))) ) { /* This is a good reply */ if(ndpi_struct->dns_dissect_response) { x++; if(flow->packet.payload[x] != '\0') { while((x < flow->packet.payload_packet_len) && (flow->packet.payload[x] != '\0')) { x++; } x++; } x += 4; if(dns_header.num_answers > 0) { u_int16_t rsp_type; u_int16_t num; for(num = 0; num < dns_header.num_answers; num++) { u_int16_t data_len; if((x+6) >= flow->packet.payload_packet_len) { break; } if((data_len = getNameLength(x, flow->packet.payload, flow->packet.payload_packet_len)) == 0) { break; } else x += data_len; rsp_type = get16(&x, flow->packet.payload); flow->protos.dns.rsp_type = rsp_type; break; } } } } } if(invalid) { NDPI_LOG(NDPI_PROTOCOL_DNS, ndpi_struct, NDPI_LOG_DEBUG, "exclude DNS.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DNS); return; } /* extract host name server */ int j = 0, max_len = sizeof(flow->host_server_name)-1, off = sizeof(struct ndpi_dns_packet_header) + 1; while(off < flow->packet.payload_packet_len && flow->packet.payload[off] != '\0') { flow->host_server_name[j] = flow->packet.payload[off]; if(j < max_len) { if(flow->host_server_name[j] < ' ') flow->host_server_name[j] = '.'; j++; } else break; off++; } if(is_query && ndpi_struct->dns_dissect_response) return; /* The response will set the verdict */ flow->host_server_name[j] = '\0'; flow->protos.dns.num_queries = (u_int8_t)dns_header.num_queries, flow->protos.dns.num_answers = (u_int8_t) (dns_header.num_answers + dns_header.authority_rrs + dns_header.additional_rrs); if(j > 0) ndpi_match_host_subprotocol(ndpi_struct, flow, (char *)flow->host_server_name, strlen((const char*)flow->host_server_name), NDPI_PROTOCOL_DNS); #ifdef DNS_DEBUG printf("[%s:%d] [num_queries=%d][num_answers=%d][reply_code=%u][rsp_type=%u][host_server_name=%s]\n", __FILE__, __LINE__, flow->protos.dns.num_queries, flow->protos.dns.num_answers, flow->protos.dns.reply_code, flow->protos.dns.rsp_type, flow->host_server_name ); #endif if(flow->packet.detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { /** Do not set the protocol with DNS if ndpi_match_host_subprotocol() has matched a subprotocol **/ NDPI_LOG(NDPI_PROTOCOL_DNS, ndpi_struct, NDPI_LOG_DEBUG, "found DNS.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, (d_port == 5355) ? NDPI_PROTOCOL_LLMNR : NDPI_PROTOCOL_DNS, NDPI_PROTOCOL_UNKNOWN); } else { NDPI_LOG(NDPI_PROTOCOL_DNS, ndpi_struct, NDPI_LOG_DEBUG, "exclude DNS.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DNS); } } } } void init_dns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("DNS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DNS, ndpi_search_dns, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/dofus.c000066400000000000000000000153351321103654100170170ustar00rootroot00000000000000/* * dofus.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_DOFUS static void ndpi_dofus_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DOFUS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_dofus(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; /* Dofus v 1.x.x */ if (packet->payload_packet_len == 13 && get_u_int16_t(packet->payload, 1) == ntohs(0x0508) && get_u_int16_t(packet->payload, 5) == ntohs(0x04a0) && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == ntohs(0x0194)) { NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "found dofus.\n"); ndpi_dofus_add_connection(ndpi_struct, flow); return; } if (flow->l4.tcp.dofus_stage == 0 && packet->payload_packet_len == 3 && memcmp(packet->payload, "HG", 2) == 0 && packet->payload[packet->payload_packet_len - 1] == 0) { flow->l4.tcp.dofus_stage = 1; NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "maybe dofus.\n"); return; } if (flow->l4.tcp.dofus_stage == 0 && packet->payload_packet_len == 35 && memcmp(packet->payload, "HC", 2) == 0 && packet->payload[packet->payload_packet_len - 1] == 0) { flow->l4.tcp.dofus_stage = 1; NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "maybe dofus.\n"); return; } if (flow->l4.tcp.dofus_stage == 0 && packet->payload_packet_len > 2 && packet->payload[0] == 'A' && (packet->payload[1] == 'x' || packet->payload[1] == 'X') && packet->payload[packet->payload_packet_len - 1] == 0) { flow->l4.tcp.dofus_stage = 1; NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "maybe dofus.\n"); return; } if (flow->l4.tcp.dofus_stage == 0 && packet->payload_packet_len == 12 && memcmp(packet->payload, "Af", 2) == 0 && packet->payload[packet->payload_packet_len - 1] == 0) { flow->l4.tcp.dofus_stage = 1; NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "maybe dofus.\n"); return; } if (flow->l4.tcp.dofus_stage == 0 && packet->payload_packet_len > 2 && memcmp(packet->payload, "Ad", 2) && packet->payload[packet->payload_packet_len - 1] == 0) { flow->l4.tcp.dofus_stage = 1; NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "maybe dofus.\n"); return; } if (packet->payload_packet_len == 11 && memcmp(packet->payload, "AT", 2) == 0 && packet->payload[10] == 0x00) { if (flow->l4.tcp.dofus_stage == 1) { NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "found dofus.\n"); ndpi_dofus_add_connection(ndpi_struct, flow); return; } } if (flow->l4.tcp.dofus_stage == 1 && packet->payload_packet_len == 5 && packet->payload[0] == 'A' && packet->payload[4] == 0x00 && (packet->payload[1] == 'T' || packet->payload[1] == 'k')) { NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "found dofus asym.\n"); ndpi_dofus_add_connection(ndpi_struct, flow); return; } /* end Dofus 1.x.x */ /* Dofus 2.0 */ if ((packet->payload_packet_len == 11 || packet->payload_packet_len == 13 || packet->payload_packet_len == 49) && get_u_int32_t(packet->payload, 0) == ntohl(0x00050800) && get_u_int16_t(packet->payload, 4) == ntohs(0x0005) && get_u_int16_t(packet->payload, 8) == ntohs(0x0005) && packet->payload[10] == 0x18) { if (packet->payload_packet_len == 13 && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) != ntohs(0x0194)) { goto exclude; } if (packet->payload_packet_len == 49 && ntohs(get_u_int16_t(packet->payload, 15)) + 17 != packet->payload_packet_len) { goto exclude; } NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "found dofus.\n"); ndpi_dofus_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len >= 41 && get_u_int16_t(packet->payload, 0) == ntohs(0x01b9) && packet->payload[2] == 0x26) { u_int16_t len, len2; len = ntohs(get_u_int16_t(packet->payload, 3)); if ((len + 5 + 2) > packet->payload_packet_len) goto exclude; len2 = ntohs(get_u_int16_t(packet->payload, 5 + len)); if (5 + len + 2 + len2 == packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "found dofus.\n"); ndpi_dofus_add_connection(ndpi_struct, flow); return; } } if (packet->payload_packet_len == 56 && memcmp(packet->payload, "\x00\x11\x35\x02\x03\x00\x93\x96\x01\x00", 10) == 0) { u_int16_t len, len2; len = ntohs(get_u_int16_t(packet->payload, 10)); if ((len + 12 + 2) > packet->payload_packet_len) goto exclude; len2 = ntohs(get_u_int16_t(packet->payload, 12 + len)); if ((12 + len + 2 + len2 + 1) > packet->payload_packet_len) goto exclude; if (12 + len + 2 + len2 + 1 == packet->payload_packet_len && packet->payload[12 + len + 2 + len2] == 0x01) { NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "found dofus.\n"); ndpi_dofus_add_connection(ndpi_struct, flow); return; } } exclude: NDPI_LOG(NDPI_PROTOCOL_DOFUS, ndpi_struct, NDPI_LOG_DEBUG, "exclude dofus.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DOFUS); } void init_dofus_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Dofus", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DOFUS, ndpi_search_dofus, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/drda.c000066400000000000000000000054651321103654100166140ustar00rootroot00000000000000/* * drda.c * * Copyright (C) 2012-16 - ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_DRDA struct ndpi_drda_hdr { u_int16_t length; u_int8_t magic; u_int8_t format; u_int16_t correlID; u_int16_t length2; u_int16_t code_pnt; }; void ndpi_search_drda(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct * packet = &flow->packet; u_int16_t payload_len = packet->payload_packet_len; u_int count = 0; // prevent integer overflow if(packet->tcp != NULL) { /* check port */ if(payload_len >= sizeof(struct ndpi_drda_hdr)) { struct ndpi_drda_hdr * drda = (struct ndpi_drda_hdr *) packet->payload; u_int16_t len = ntohs(drda->length); /* check first header */ if(len != ntohs(drda->length2) + 6 || drda->magic != 0xd0) goto no_drda; /* check if there are more drda headers */ if(payload_len > len) { count = len; while(count + sizeof(struct ndpi_drda_hdr) < payload_len) { /* update info */ drda = (struct ndpi_drda_hdr *)(packet->payload + count); len = ntohs(drda->length); if(len != ntohs(drda->length2) + 6 || drda->magic != 0xd0) goto no_drda; count += len; } if(count != payload_len) goto no_drda; } NDPI_LOG(NDPI_PROTOCOL_DRDA, ndpi_struct, NDPI_LOG_DEBUG, "found DRDA.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DRDA, NDPI_PROTOCOL_UNKNOWN); return; } } no_drda: NDPI_LOG(NDPI_PROTOCOL_DRDA, ndpi_struct, NDPI_LOG_DEBUG, "exclude DRDA.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DRDA); } /* ***************************************************************** */ void init_drda_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("DRDA", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DRDA, ndpi_search_drda, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif /* NDPI_PROTOCOL_DRDA */ nDPI-2.2/src/lib/protocols/dropbox.c000066400000000000000000000057141321103654100173540ustar00rootroot00000000000000/* * dropbox.c * * Copyright (C) 2012-16 by ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_DROPBOX #define DB_LSP_PORT 17500 static void ndpi_int_dropbox_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t due_to_correlation) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_DROPBOX, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_dropbox(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { u_int16_t dropbox_port = htons(DB_LSP_PORT); if((packet->udp->source == dropbox_port) && (packet->udp->dest == dropbox_port)) { if(payload_len > 2) { if(strncmp((const char *)packet->payload, "{\"host_int\"", 11) == 0) { NDPI_LOG(NDPI_PROTOCOL_DROPBOX, ndpi_struct, NDPI_LOG_DEBUG, "Found dropbox.\n"); ndpi_int_dropbox_add_connection(ndpi_struct, flow, 0); return; } } } } NDPI_LOG(NDPI_PROTOCOL_DROPBOX, ndpi_struct, NDPI_LOG_DEBUG, "exclude dropbox.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_DROPBOX); } void ndpi_search_dropbox(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_DROPBOX, ndpi_struct, NDPI_LOG_DEBUG, "dropbox detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_DROPBOX) { if (packet->tcp_retransmission == 0) { ndpi_check_dropbox(ndpi_struct, flow); } } } void init_dropbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("DROPBOX", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_DROPBOX, ndpi_search_dropbox, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/eaq.c000066400000000000000000000054051321103654100164420ustar00rootroot00000000000000/* * eaq.c * * Copyright (C) 2015 - ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ /* EAQ: Entitade Aferidora da Qualidade de Banda Larga http://www.brasilbandalarga.com.br */ #include "ndpi_api.h" #define EAQ_DEFAULT_PORT 6000 #define EAQ_DEFAULT_SIZE 16 #ifdef NDPI_PROTOCOL_EAQ static void ndpi_int_eaq_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_EAQ, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_eaq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest); if((packet->payload_packet_len != EAQ_DEFAULT_SIZE) || ((sport != EAQ_DEFAULT_PORT) && (dport != EAQ_DEFAULT_PORT))) { exclude_eaq: NDPI_LOG(NDPI_PROTOCOL_EAQ, ndpi_struct, NDPI_LOG_DEBUG, "Exclude eaq.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_EAQ); return; } if(packet->udp != NULL) { u_int32_t seq = (packet->payload[0] * 1000) + (packet->payload[1] * 100) + (packet->payload[2] * 10) + packet->payload[3]; if(flow->l4.udp.eaq_pkt_id == 0) flow->l4.udp.eaq_sequence = seq; else { if((flow->l4.udp.eaq_sequence == seq) || ((flow->l4.udp.eaq_sequence+1) == seq)) { ; /* Looks good */ } else goto exclude_eaq; } if(++flow->l4.udp.eaq_pkt_id == 4) { /* We have collected enough packets so we assume it's EAQ */ NDPI_LOG(NDPI_PROTOCOL_EAQ, ndpi_struct, NDPI_LOG_DEBUG, "found eaq.\n"); ndpi_int_eaq_add_connection(ndpi_struct, flow); } } else goto exclude_eaq; } void init_eaq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("EAQ", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_EAQ, ndpi_search_eaq, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/edonkey.c000066400000000000000000000162331321103654100173330ustar00rootroot00000000000000/* * edonkey.c * * Copyright (C) 2014 Tomasz Bujlow * * The signature is based on the Libprotoident library. * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_EDONKEY static void ndpi_int_edonkey_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_EDONKEY, NDPI_PROTOCOL_UNKNOWN); } static int ndpi_edonkey_payload_check(const u_int8_t *data, u_int32_t len) { if ((len >= 4) && (data[0] == 0xe3) && (data[2] == 0x00) && (data[3] == 0x00)) return 1; if ((len >= 4) && (data[0] == 0xc5) && (data[2] == 0x00) && (data[3] == 0x00)) return 1; if ((len >= 2) && (data[0] == 0xe5) && (data[1] == 0x43)) return 1; if ((len >= 4) && (data[0] == 0xe5) && (data[1] == 0x08) && (data[2] == 0x78) && (data[3] == 0xda)) return 1; if ((len >= 4) && (data[0] == 0xe5) && (data[1] == 0x28) && (data[2] == 0x78) && (data[3] == 0xda)) return 1; if ((len >= 2) && (data[0] == 0xc5) && (data[1] == 0x90)) return 1; if ((len >= 2) && (data[0] == 0xc5) && (data[1] == 0x91)) return 1; if ((len == 2) && (data[0] == 0xc5) && (data[1] == 0x92)) return 1; if ((len == 2) && (data[0] == 0xc5) && (data[1] == 0x93)) return 1; if ((len >= 38 && len <= 70) && (data[0] == 0xc5) && (data[1] == 0x94)) return 1; if ((len >= 2) && (data[0] == 0xe3) && (data[1] == 0x9a)) return 1; if ((len >= 2) && (data[0] == 0xe3) && (data[1] == 0x9b)) return 1; if ((len == 6) && (data[0] == 0xe3) && (data[1] == 0x96)) return 1; if ((len <= 34 && ((len - 2) % 4 == 0)) && (data[0] == 0xe3) && (data[1] == 0x97)) return 1; if ((len >= 2) && (data[0] == 0xe3) && (data[1] == 0x92)) return 1; if ((len >= 2) && (data[0] == 0xe3) && (data[1] == 0x94)) return 1; if ((len >= 2) && (data[0] == 0xe3) && (data[1] == 0x98)) return 1; if ((len >= 2) && (data[0] == 0xe3) && (data[1] == 0x99)) return 1; if ((len == 6) && (data[0] == 0xe3) && (data[1] == 0xa2)) return 1; if ((len >= 2) && (data[0] == 0xe3) && (data[1] == 0xa3)) return 1; if ((len == 27) && (data[0] == 0xe4) && (data[1] == 0x00)) return 1; if ((len == 529) && (data[0] == 0xe4) && (data[1] == 0x08)) return 1; if ((len == 18) && (data[0] == 0xe4) && (data[1] == 0x01) && (data[2] == 0x00) && (data[3] == 0x00)) return 1; if ((len == 523) && (data[0] == 0xe4) && (data[1] == 0x09)) return 1; if ((len == 35) && (data[0] == 0xe4) && (data[1] == 0x21)) return 1; if ((len == 19) && (data[0] == 0xe4) && (data[1] == 0x4b)) return 1; if ((len >= 2) && (data[0] == 0xe4) && (data[1] == 0x11)) return 1; if ((len == 22 || len == 38 || len == 28) && (data[0] == 0xe4) && (data[1] == 0x19)) return 1; if ((len == 35) && (data[0] == 0xe4) && (data[1] == 0x20)) return 1; if ((len == 27) && (data[0] == 0xe4) && (data[1] == 0x18)) return 1; if ((len == 27) && (data[0] == 0xe4) && (data[1] == 0x10)) return 1; if ((len == 6) && (data[0] == 0xe4) && (data[1] == 0x58)) return 1; if ((len == 4) && (data[0] == 0xe4) && (data[1] == 0x50)) return 1; if ((len == 36) && (data[0] == 0xe4) && (data[1] == 0x52)) return 1; if ((len == 48) && (data[0] == 0xe4) && (data[1] == 0x40)) return 1; if ((len == 225) && (data[0] == 0xe4) && (data[1] == 0x43)) return 1; if ((len == 19) && (data[0] == 0xe4) && (data[1] == 0x48)) return 1; if ((len == 119 || len == 69 || len == 294) && (data[0] == 0xe4) && (data[1] == 0x29)) return 1; if ((len == 119 || len == 69 || len == 294 || len == 44 || len == 269) && (data[0] == 0xe4) && (data[1] == 0x28)) return 1; return 0; } static void ndpi_check_edonkey(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Break after 20 packets. */ if (flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_EDONKEY, ndpi_struct, NDPI_LOG_DEBUG, "Exclude EDONKEY.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_EDONKEY); return; } /* Check if we so far detected the protocol in the request or not. */ if (flow->edonkey_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_EDONKEY, ndpi_struct, NDPI_LOG_DEBUG, "EDONKEY stage 0: \n"); if (ndpi_edonkey_payload_check(packet->payload, payload_len)) { NDPI_LOG(NDPI_PROTOCOL_EDONKEY, ndpi_struct, NDPI_LOG_DEBUG, "Possible EDONKEY request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->edonkey_stage = packet->packet_direction + 1; } } else { NDPI_LOG(NDPI_PROTOCOL_EDONKEY, ndpi_struct, NDPI_LOG_DEBUG, "EDONKEY stage %u: \n", flow->edonkey_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->edonkey_stage - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 0) || (ndpi_edonkey_payload_check(packet->payload, payload_len))) { NDPI_LOG(NDPI_PROTOCOL_EDONKEY, ndpi_struct, NDPI_LOG_DEBUG, "Found EDONKEY.\n"); ndpi_int_edonkey_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_EDONKEY, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to EDONKEY, resetting the stage to 0...\n"); flow->edonkey_stage = 0; } } } void ndpi_search_edonkey(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_EDONKEY, ndpi_struct, NDPI_LOG_DEBUG, "EDONKEY detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_EDONKEY) { if (packet->tcp_retransmission == 0) { ndpi_check_edonkey(ndpi_struct, flow); } } } void init_edonkey_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("eDonkey", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_EDONKEY, ndpi_search_edonkey, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/fasttrack.c000066400000000000000000000071341321103654100176570ustar00rootroot00000000000000/* * fasttrack.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_FASTTRACK static void ndpi_int_fasttrack_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FASTTRACK, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_fasttrack_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if ( (packet->payload != NULL) && (packet->payload_packet_len > 6) && (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a)) { NDPI_LOG(NDPI_PROTOCOL_FASTTRACK, ndpi_struct, NDPI_LOG_TRACE, "detected 0d0a at the end of the packet.\n"); if (memcmp(packet->payload, "GIVE ", 5) == 0 && packet->payload_packet_len >= 8) { u_int16_t i; for (i = 5; i < (packet->payload_packet_len - 2); i++) { // make shure that the argument to GIVE is numeric if (!(packet->payload[i] >= '0' && packet->payload[i] <= '9')) { goto exclude_fasttrack; } } NDPI_LOG(NDPI_PROTOCOL_FASTTRACK, ndpi_struct, NDPI_LOG_TRACE, "FASTTRACK GIVE DETECTED\n"); ndpi_int_fasttrack_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 50 && memcmp(packet->payload, "GET /", 5) == 0) { u_int8_t a = 0; NDPI_LOG(NDPI_PROTOCOL_FASTTRACK, ndpi_struct, NDPI_LOG_TRACE, "detected GET /. \n"); ndpi_parse_packet_line_info(ndpi_struct, flow); for (a = 0; a < packet->parsed_lines; a++) { if ((packet->line[a].len > 17 && memcmp(packet->line[a].ptr, "X-Kazaa-Username: ", 18) == 0) || (packet->line[a].len > 23 && memcmp(packet->line[a].ptr, "User-Agent: PeerEnabler/", 24) == 0)) { NDPI_LOG(NDPI_PROTOCOL_FASTTRACK, ndpi_struct, NDPI_LOG_TRACE, "detected X-Kazaa-Username: || User-Agent: PeerEnabler/\n"); ndpi_int_fasttrack_add_connection(ndpi_struct, flow); return; } } } } exclude_fasttrack: NDPI_LOG(NDPI_PROTOCOL_FASTTRACK, ndpi_struct, NDPI_LOG_TRACE, "fasttrack/kazaa excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FASTTRACK); } void init_fasttrack_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("FastTrack", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_FASTTRACK, ndpi_search_fasttrack_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/fiesta.c000066400000000000000000000102441321103654100171440ustar00rootroot00000000000000/* * fiesta.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* include files */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_FIESTA static void ndpi_int_fiesta_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FIESTA, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_fiesta(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_FIESTA, ndpi_struct, NDPI_LOG_DEBUG, "search fiesta.\n"); if (flow->l4.tcp.fiesta_stage == 0 && packet->payload_packet_len == 5 && get_u_int16_t(packet->payload, 0) == ntohs(0x0407) && (packet->payload[2] == 0x08) && (packet->payload[4] == 0x00 || packet->payload[4] == 0x01)) { NDPI_LOG(NDPI_PROTOCOL_FIESTA, ndpi_struct, NDPI_LOG_DEBUG, "maybe fiesta symmetric, first packet.\n"); flow->l4.tcp.fiesta_stage = 1 + packet->packet_direction; goto maybe_fiesta; } if (flow->l4.tcp.fiesta_stage == (2 - packet->packet_direction) && ((packet->payload_packet_len > 1 && packet->payload_packet_len - 1 == packet->payload[0]) || (packet->payload_packet_len > 3 && packet->payload[0] == 0 && get_l16(packet->payload, 1) == packet->payload_packet_len - 3))) { NDPI_LOG(NDPI_PROTOCOL_FIESTA, ndpi_struct, NDPI_LOG_DEBUG, "Maybe fiesta.\n"); goto maybe_fiesta; } if (flow->l4.tcp.fiesta_stage == (1 + packet->packet_direction)) { if (packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x03050c01)) { goto add_fiesta; } if (packet->payload_packet_len == 5 && get_u_int32_t(packet->payload, 0) == htonl(0x04030c01) && packet->payload[4] == 0) { goto add_fiesta; } if (packet->payload_packet_len == 6 && get_u_int32_t(packet->payload, 0) == htonl(0x050e080b)) { goto add_fiesta; } if (packet->payload_packet_len == 100 && packet->payload[0] == 0x63 && packet->payload[61] == 0x52 && packet->payload[81] == 0x5a && get_u_int16_t(packet->payload, 1) == htons(0x3810) && get_u_int16_t(packet->payload, 62) == htons(0x6f75)) { goto add_fiesta; } if (packet->payload_packet_len > 3 && packet->payload_packet_len - 1 == packet->payload[0] && get_u_int16_t(packet->payload, 1) == htons(0x140c)) { goto add_fiesta; } } NDPI_LOG(NDPI_PROTOCOL_FIESTA, ndpi_struct, NDPI_LOG_DEBUG, "exclude fiesta.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FIESTA); return; maybe_fiesta: NDPI_LOG(NDPI_PROTOCOL_FIESTA, ndpi_struct, NDPI_LOG_DEBUG, "Stage is set to %d.\n", flow->l4.tcp.fiesta_stage); return; add_fiesta: NDPI_LOG(NDPI_PROTOCOL_FIESTA, ndpi_struct, NDPI_LOG_DEBUG, "detected fiesta.\n"); ndpi_int_fiesta_add_connection(ndpi_struct, flow); return; } void init_fiesta_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Fiesta", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_FIESTA, ndpi_search_fiesta, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/filetopia.c000066400000000000000000000067171321103654100176570ustar00rootroot00000000000000/* * filetopia.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_FILETOPIA static void ndpi_int_filetopia_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FILETOPIA, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_filetopia_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (flow->l4.tcp.filetopia_stage == 0) { if (packet->payload_packet_len >= 50 && packet->payload_packet_len <= 70 && packet->payload[0] == 0x03 && packet->payload[1] == 0x9a && packet->payload[3] == 0x22 && packet->payload[packet->payload_packet_len - 1] == 0x2b) { NDPI_LOG(NDPI_PROTOCOL_FILETOPIA, ndpi_struct, NDPI_LOG_DEBUG, "Filetopia stage 1 detected\n"); flow->l4.tcp.filetopia_stage = 1; return; } } else if (flow->l4.tcp.filetopia_stage == 1) { if (packet->payload_packet_len >= 100 && packet->payload[0] == 0x03 && packet->payload[1] == 0x9a && (packet->payload[3] == 0x22 || packet->payload[3] == 0x23)) { int i; for (i = 0; i < 10; i++) { // check 10 bytes for valid ASCII printable characters if (!(packet->payload[5 + i] >= 0x20 && packet->payload[5 + i] <= 0x7e)) { goto end_filetopia_nothing_found; } } NDPI_LOG(NDPI_PROTOCOL_FILETOPIA, ndpi_struct, NDPI_LOG_DEBUG, "Filetopia stage 2 detected\n"); flow->l4.tcp.filetopia_stage = 2; return; } } else if (flow->l4.tcp.filetopia_stage == 2) { if (packet->payload_packet_len >= 4 && packet->payload_packet_len <= 100 && packet->payload[0] == 0x03 && packet->payload[1] == 0x9a && (packet->payload[3] == 0x22 || packet->payload[3] == 0x23)) { NDPI_LOG(NDPI_PROTOCOL_FILETOPIA, ndpi_struct, NDPI_LOG_DEBUG, "Filetopia detected\n"); ndpi_int_filetopia_add_connection(ndpi_struct, flow); return; } } end_filetopia_nothing_found: NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FILETOPIA); } void init_filetopia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Filetopia", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_FILETOPIA, ndpi_search_filetopia_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/fix.c000066400000000000000000000045151321103654100164630ustar00rootroot00000000000000/* * fix.c * * Copyright (C) 2017 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_FIX void ndpi_search_fix(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->tcp) { // 8= if(packet->payload[0] == 0x38 && packet->payload[1] == 0x3d) { // FIX. if(packet->payload[2] == 0x46 && packet->payload[3] == 0x49 && packet->payload[4] == 0x58 && packet->payload[5] == 0x2e) { NDPI_LOG(NDPI_PROTOCOL_FIX, ndpi_struct, NDPI_LOG_DEBUG, "FIX detected.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FIX, NDPI_PROTOCOL_UNKNOWN); return; } // 0. 9= if(packet->payload[2] == 0x4f && packet->payload[3] == 0x01 && packet->payload[4] == 0x39 && packet->payload[5] == 0x3d) { NDPI_LOG(NDPI_PROTOCOL_FIX, ndpi_struct, NDPI_LOG_DEBUG, "FIX detected.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FIX, NDPI_PROTOCOL_UNKNOWN); return; } } } /* exclude FIX */ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FIX); } void init_fix_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("FIX", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_FIX, ndpi_search_fix, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/florensia.c000066400000000000000000000131361321103654100176560ustar00rootroot00000000000000/* * florensia.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_FLORENSIA static void ndpi_florensia_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FLORENSIA, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_florensia(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "search florensia.\n"); if (packet->tcp != NULL) { if (packet->payload_packet_len == 5 && get_l16(packet->payload, 0) == packet->payload_packet_len && packet->payload[2] == 0x65 && packet->payload[4] == 0xff) { if (flow->florensia_stage == 1) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "found florensia.\n"); ndpi_florensia_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "maybe florensia -> stage is set to 1.\n"); flow->florensia_stage = 1; return; } if (packet->payload_packet_len > 8 && get_l16(packet->payload, 0) == packet->payload_packet_len && get_u_int16_t(packet->payload, 2) == htons(0x0201) && get_u_int32_t(packet->payload, 4) == htonl(0xFFFFFFFF)) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "maybe florensia -> stage is set to 1.\n"); flow->florensia_stage = 1; return; } if (packet->payload_packet_len == 406 && get_l16(packet->payload, 0) == packet->payload_packet_len && packet->payload[2] == 0x63) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "maybe florensia -> stage is set to 1.\n"); flow->florensia_stage = 1; return; } if (packet->payload_packet_len == 12 && get_l16(packet->payload, 0) == packet->payload_packet_len && get_u_int16_t(packet->payload, 2) == htons(0x0301)) { if (flow->florensia_stage == 1) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "found florensia.\n"); ndpi_florensia_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "maybe florensia -> stage is set to 1.\n"); flow->florensia_stage = 1; return; } if (flow->florensia_stage == 1) { if (packet->payload_packet_len == 8 && get_l16(packet->payload, 0) == packet->payload_packet_len && get_u_int16_t(packet->payload, 2) == htons(0x0302) && get_u_int32_t(packet->payload, 4) == htonl(0xFFFFFFFF)) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "found florensia asymmetrically.\n"); ndpi_florensia_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 24 && get_l16(packet->payload, 0) == packet->payload_packet_len && get_u_int16_t(packet->payload, 2) == htons(0x0202) && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) == htonl(0xFFFFFFFF)) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "found florensia.\n"); ndpi_florensia_add_connection(ndpi_struct, flow); return; } if (flow->packet_counter < 10 && get_l16(packet->payload, 0) == packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "maybe florensia.\n"); return; } } } if (packet->udp != NULL) { if (flow->florensia_stage == 0 && packet->payload_packet_len == 6 && get_u_int16_t(packet->payload, 0) == ntohs(0x0503) && get_u_int32_t(packet->payload, 2) == htonl(0xFFFF0000)) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "maybe florensia -> stage is set to 1.\n"); flow->florensia_stage = 1; return; } if (flow->florensia_stage == 1 && packet->payload_packet_len == 8 && get_u_int16_t(packet->payload, 0) == ntohs(0x0500) && get_u_int16_t(packet->payload, 4) == htons(0x4191)) { NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "found florensia.\n"); ndpi_florensia_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_FLORENSIA, ndpi_struct, NDPI_LOG_DEBUG, "exclude florensia.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FLORENSIA); } void init_florensia_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Florensia", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_FLORENSIA, ndpi_search_florensia, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ftp_control.c000066400000000000000000000537601321103654100202340ustar00rootroot00000000000000/* * ftp_control.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_FTP_CONTROL static void ndpi_int_ftp_control_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FTP_CONTROL, NDPI_PROTOCOL_UNKNOWN); } static int ndpi_ftp_control_check_request(const u_int8_t *payload, size_t payload_len) { if (ndpi_match_strprefix(payload, payload_len, "ABOR")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "ACCT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "ADAT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "ALLO")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "APPE")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "AUTH")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "CCC")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "CDUP")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "CONF")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "CWD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "DELE")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "ENC")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "EPRT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "EPSV")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "FEAT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "HELP")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "LANG")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "LIST")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "LPRT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "LPSV")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "MDTM")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "MIC")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "MKD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "MLSD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "MLST")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "MODE")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "NLST")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "NOOP")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "OPTS")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "PASS")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "PASV")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "PBSZ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "PORT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "PROT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "PWD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "QUIT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "REIN")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "REST")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "RETR")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "RMD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "RNFR")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "RNTO")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "SITE")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "SIZE")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "SMNT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "STAT")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "STOR")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "STOU")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "STRU")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "SYST")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "TYPE")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "USER")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XCUP")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XMKD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XPWD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XRCP")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XRMD")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XRSQ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XSEM")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "XSEN")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "HOST")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "abor")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "acct")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "adat")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "allo")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "appe")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "auth")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "ccc")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "cdup")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "conf")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "cwd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "dele")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "enc")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "eprt")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "epsv")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "feat")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "help")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "lang")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "list")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "lprt")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "lpsv")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "mdtm")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "mic")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "mkd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "mlsd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "mlst")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "mode")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "nlst")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "noop")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "opts")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "pass")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "pasv")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "pbsz")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "port")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "prot")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "pwd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "quit")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "rein")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "rest")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "retr")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "rmd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "rnfr")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "rnto")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "site")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "size")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "smnt")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "stat")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "stor")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "stou")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "stru")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "syst")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "type")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "user")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xcup")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xmkd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xpwd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xrcp")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xrmd")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xrsq")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xsem")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "xsen")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "host")) { return 1; } return 0; } static int ndpi_ftp_control_check_response(const u_int8_t *payload, size_t payload_len) { if (ndpi_match_strprefix(payload, payload_len, "110-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "120-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "125-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "150-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "202-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "211-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "212-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "213-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "214-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "215-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "220-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "221-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "225-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "226-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "227-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "228-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "229-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "230-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "231-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "232-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "250-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "257-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "331-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "332-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "350-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "421-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "425-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "426-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "430-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "434-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "450-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "451-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "452-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "501-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "502-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "503-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "504-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "530-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "532-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "550-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "551-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "552-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "553-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "631-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "632-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "633-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10054-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10060-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10061-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10066-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10068-")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "110 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "120 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "125 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "150 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "202 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "211 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "212 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "213 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "214 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "215 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "220 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "221 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "225 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "226 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "227 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "228 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "229 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "230 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "231 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "232 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "250 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "257 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "331 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "332 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "350 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "421 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "425 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "426 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "430 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "434 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "450 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "451 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "452 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "501 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "502 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "503 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "504 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "530 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "532 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "550 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "551 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "552 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "553 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "631 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "632 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "633 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10054 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10060 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10061 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10066 ")) { return 1; } if (ndpi_match_strprefix(payload, payload_len, "10068 ")) { return 1; } return 0; } static void ndpi_check_ftp_control(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Check connection over TCP */ if(packet->tcp) { /* Exclude SMTP, which uses similar commands. */ if (packet->tcp->dest == htons(25) || packet->tcp->source == htons(25)) { NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "Exclude FTP_CONTROL.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FTP_CONTROL); return; } /* Break after 20 packets. */ if (flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "Exclude FTP_CONTROL.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FTP_CONTROL); return; } /* Check if we so far detected the protocol in the request or not. */ if (flow->ftp_control_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "FTP_CONTROL stage 0: \n"); if ((payload_len > 0) && ndpi_ftp_control_check_request(packet->payload, payload_len)) { NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "Possible FTP_CONTROL request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->ftp_control_stage = packet->packet_direction + 1; } } else { NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "FTP_CONTROL stage %u: \n", flow->ftp_control_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->ftp_control_stage - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len > 0) && ndpi_ftp_control_check_response(packet->payload, payload_len)) { NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "Found FTP_CONTROL.\n"); ndpi_int_ftp_control_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to FTP_CONTROL, resetting the stage to 0...\n"); flow->ftp_control_stage = 0; } } } } void ndpi_search_ftp_control(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_FTP_CONTROL, ndpi_struct, NDPI_LOG_DEBUG, "FTP_CONTROL detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_FTP_CONTROL) { if (packet->tcp_retransmission == 0) { ndpi_check_ftp_control(ndpi_struct, flow); } } } void init_ftp_control_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("FTP_CONTROL", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_FTP_CONTROL, ndpi_search_ftp_control, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ftp_data.c000066400000000000000000000220221321103654100174500ustar00rootroot00000000000000/* * ftp_data.c * * Copyright (C) 2016 - ntop.org * * The signature is based on the Libprotoident library. * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_FTP_DATA static void ndpi_int_ftp_data_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_FTP_DATA, NDPI_PROTOCOL_UNKNOWN); } static int ndpi_match_ftp_data_port(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* Check connection over TCP */ if(packet->tcp) { if(packet->tcp->dest == htons(20) || packet->tcp->source == htons(20)) { return 1; } } return 0; } static int ndpi_match_ftp_data_directory(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if((payload_len >= 4) && ((packet->payload[0] == '-') || (packet->payload[0] == 'd')) && ((packet->payload[1] == '-') || (packet->payload[1] == 'r')) && ((packet->payload[2] == '-') || (packet->payload[2] == 'w')) && ((packet->payload[3] == '-') || (packet->payload[3] == 'x'))) { return 1; } return 0; } static int ndpi_match_file_header(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* A FTP packet is pretty long so 256 is a bit conservative but it should be OK */ if(packet->payload_packet_len < 256) return 0; /* RIFF is a meta-format for storing AVI and WAV files */ if(ndpi_match_strprefix(packet->payload, payload_len, "RIFF")) return 1; /* MZ is a .exe file */ if((packet->payload[0] == 'M') && (packet->payload[1] == 'Z') && (packet->payload[3] == 0x00)) return 1; /* Ogg files */ if(ndpi_match_strprefix(packet->payload, payload_len, "OggS")) return 1; /* ZIP files */ if((packet->payload[0] == 'P') && (packet->payload[1] == 'K') && (packet->payload[2] == 0x03) && (packet->payload[3] == 0x04)) return 1; /* MPEG files */ if((packet->payload[0] == 0x00) && (packet->payload[1] == 0x00) && (packet->payload[2] == 0x01) && (packet->payload[3] == 0xba)) return 1; /* RAR files */ if(ndpi_match_strprefix(packet->payload, payload_len, "Rar!")) return 1; /* EBML */ if((packet->payload[0] == 0x1a) && (packet->payload[1] == 0x45) && (packet->payload[2] == 0xdf) && (packet->payload[3] == 0xa3)) return 1; /* JPG */ if((packet->payload[0] == 0xff) && (packet->payload[1] ==0xd8)) return 1; /* GIF */ if(ndpi_match_strprefix(packet->payload, payload_len, "GIF8")) return 1; /* PHP scripts */ if((packet->payload[0] == 0x3c) && (packet->payload[1] == 0x3f) && (packet->payload[2] == 0x70) && (packet->payload[3] == 0x68)) return 1; /* Unix scripts */ if((packet->payload[0] == 0x23) && (packet->payload[1] == 0x21) && (packet->payload[2] == 0x2f) && (packet->payload[3] == 0x62)) return 1; /* PDFs */ if(ndpi_match_strprefix(packet->payload, payload_len, "%PDF")) return 1; /* PNG */ if((packet->payload[0] == 0x89) && (packet->payload[1] == 'P') && (packet->payload[2] == 'N') && (packet->payload[3] == 'G')) return 1; /* HTML */ if(ndpi_match_strprefix(packet->payload, payload_len, "payload[0] == 0x0a) && (packet->payload[1] == '<') && (packet->payload[2] == '!') && (packet->payload[3] == 'D')) return 1; /* 7zip */ if((packet->payload[0] == 0x37) && (packet->payload[1] == 0x7a) && (packet->payload[2] == 0xbc) && (packet->payload[3] == 0xaf)) return 1; /* gzip */ if((packet->payload[0] == 0x1f) && (packet->payload[1] == 0x8b) && (packet->payload[2] == 0x08)) return 1; /* XML */ if(ndpi_match_strprefix(packet->payload, payload_len, "payload, payload_len, "fLaC")) return 1; /* MP3 */ if((packet->payload[0] == 'I') && (packet->payload[1] == 'D') && (packet->payload[2] == '3') && (packet->payload[3] == 0x03)) return 1; if(ndpi_match_strprefix(packet->payload, payload_len, "\xff\xfb\x90\xc0")) return 1; /* RPM */ if((packet->payload[0] == 0xed) && (packet->payload[1] == 0xab) && (packet->payload[2] == 0xee) && (packet->payload[3] == 0xdb)) return 1; /* Wz Patch */ if(ndpi_match_strprefix(packet->payload, payload_len, "WzPa")) return 1; /* Flash Video */ if((packet->payload[0] == 'F') && (packet->payload[1] == 'L') && (packet->payload[2] == 'V') && (packet->payload[3] == 0x01)) return 1; /* .BKF (Microsoft Tape Format) */ if(ndpi_match_strprefix(packet->payload, payload_len, "TAPE")) return 1; /* MS Office Doc file - this is unpleasantly geeky */ if((packet->payload[0] == 0xd0) && (packet->payload[1] == 0xcf) && (packet->payload[2] == 0x11) && (packet->payload[3] == 0xe0)) return 1; /* ASP */ if((packet->payload[0] == 0x3c) && (packet->payload[1] == 0x25) && (packet->payload[2] == 0x40) && (packet->payload[3] == 0x20)) return 1; /* WMS file */ if((packet->payload[0] == 0x3c) && (packet->payload[1] == 0x21) && (packet->payload[2] == 0x2d) && (packet->payload[3] == 0x2d)) return 1; /* ar archive, typically .deb files */ if(ndpi_match_strprefix(packet->payload, payload_len, "!payload, payload_len, "payload, "jabber", packet->payload_packet_len) == NULL)) return 1; if(ndpi_match_strprefix(packet->payload, payload_len, "payload, payload_len, "SPFI")) return 1; /* ABIF - Applied Biosystems */ if(ndpi_match_strprefix(packet->payload, payload_len, "ABIF")) return 1; /* bzip2 - other digits are also possible instead of 9 */ if((packet->payload[0] == 'B') && (packet->payload[1] == 'Z') && (packet->payload[2] == 'h') && (packet->payload[3] == '9')) return 1; /* Some other types of files */ if((packet->payload[0] == '<') && (packet->payload[1] == 'c') && (packet->payload[2] == 'f')) return 1; if((packet->payload[0] == '<') && (packet->payload[1] == 'C') && (packet->payload[2] == 'F')) return 1; if(ndpi_match_strprefix(packet->payload, payload_len, ".tem")) return 1; if(ndpi_match_strprefix(packet->payload, payload_len, ".ite")) return 1; if(ndpi_match_strprefix(packet->payload, payload_len, ".lef")) return 1; return 0; } static void ndpi_check_ftp_data(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if((packet->payload_packet_len > 0) && (ndpi_match_file_header(ndpi_struct, flow) || ndpi_match_ftp_data_directory(ndpi_struct, flow) || ndpi_match_ftp_data_port(ndpi_struct, flow) ) ) { NDPI_LOG(NDPI_PROTOCOL_FTP_DATA, ndpi_struct, NDPI_LOG_DEBUG, "Possible FTP_DATA request detected...\n"); ndpi_int_ftp_data_add_connection(ndpi_struct, flow); } else NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FTP_DATA); } void ndpi_search_ftp_data(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { /* Break after 20 packets. */ if(flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_FTP_DATA, ndpi_struct, NDPI_LOG_DEBUG, "Exclude FTP_DATA.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_FTP_DATA); return; } NDPI_LOG(NDPI_PROTOCOL_FTP_DATA, ndpi_struct, NDPI_LOG_DEBUG, "FTP_DATA detection...\n"); ndpi_check_ftp_data(ndpi_struct, flow); } void init_ftp_data_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("FTP_DATA", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_FTP_DATA, ndpi_search_ftp_data, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/git.c000066400000000000000000000047501321103654100164610ustar00rootroot00000000000000/* * git.c * * Copyright (C) 2012-16 - ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_GIT #define GIT_PORT 9418 void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct * packet = &flow->packet; if((packet->tcp != NULL) && (packet->payload_packet_len > 4)) { if((ntohs(packet->tcp->source) == GIT_PORT) || (ntohs(packet->tcp->dest) == GIT_PORT)) { const u_int8_t * pp = packet->payload; u_int16_t payload_len = packet->payload_packet_len; u_int8_t found_git = 1; u_int16_t offset = 0; while((offset+4) < payload_len) { char len[5]; u_int32_t git_pkt_len; memcpy(&len, &pp[offset], 4), len[4] = 0; git_pkt_len = atoi(len); if((payload_len < git_pkt_len) || (git_pkt_len == 0 /* Bad */)) { found_git = 0; break; } else offset += git_pkt_len, payload_len -= git_pkt_len; } if(found_git) { NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "found Git.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GIT, NDPI_PROTOCOL_UNKNOWN); return; } } } NDPI_LOG(NDPI_PROTOCOL_GIT, ndpi_struct, NDPI_LOG_DEBUG, "exclude Git.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_GIT); } /* ***************************************************************** */ void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Git", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_GIT, ndpi_search_git, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif /* NDPI_PROTOCOL_GIT */ nDPI-2.2/src/lib/protocols/gnutella.c000066400000000000000000000422221321103654100175050ustar00rootroot00000000000000/* * gnutella.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* include files */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_GNUTELLA static void ndpi_int_gnutella_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GNUTELLA, NDPI_PROTOCOL_UNKNOWN); if (src != NULL) { src->gnutella_ts = packet->tick_timestamp; if (packet->udp != NULL) { if (!src->detected_gnutella_udp_port1) { src->detected_gnutella_udp_port1 = (packet->udp->source); NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "GNUTELLA UDP PORT1 DETECTED as %u\n", src->detected_gnutella_udp_port1); } else if ((ntohs(packet->udp->source) != src->detected_gnutella_udp_port1) && !src->detected_gnutella_udp_port2) { src->detected_gnutella_udp_port2 = (packet->udp->source); NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "GNUTELLA UDP PORT2 DETECTED as %u\n", src->detected_gnutella_udp_port2); } } } if (dst != NULL) { dst->gnutella_ts = packet->tick_timestamp; } } void ndpi_search_gnutella(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; u_int16_t c; if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_GNUTELLA) { if (src != NULL && ((u_int32_t) (packet->tick_timestamp - src->gnutella_ts) < ndpi_struct->gnutella_timeout)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "gnutella : save src connection packet detected\n"); src->gnutella_ts = packet->tick_timestamp; } else if (dst != NULL && ((u_int32_t) (packet->tick_timestamp - dst->gnutella_ts) < ndpi_struct->gnutella_timeout)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "gnutella : save dst connection packet detected\n"); dst->gnutella_ts = packet->tick_timestamp; } if (src != NULL && (packet->tick_timestamp - src->gnutella_ts) > ndpi_struct->gnutella_timeout) { src->detected_gnutella_udp_port1 = 0; src->detected_gnutella_udp_port2 = 0; } if (dst != NULL && (packet->tick_timestamp - dst->gnutella_ts) > ndpi_struct->gnutella_timeout) { dst->detected_gnutella_udp_port1 = 0; dst->detected_gnutella_udp_port2 = 0; } return; } /* skip packets without payload */ if (packet->payload_packet_len < 2) { return; } if (packet->tcp != NULL) { /* this case works asymmetrically */ if (packet->payload_packet_len > 10 && memcmp(packet->payload, "GNUTELLA/", 9) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "GNUTELLA DETECTED\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } /* this case works asymmetrically */ if (packet->payload_packet_len > 17 && memcmp(packet->payload, "GNUTELLA CONNECT/", 17) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "GNUTELLA DETECTED\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 50 && ((memcmp(packet->payload, "GET /get/", 9) == 0) || (memcmp(packet->payload, "GET /uri-res/", 13) == 0) )) { ndpi_parse_packet_line_info(ndpi_struct, flow); for (c = 0; c < packet->parsed_lines; c++) { if ((packet->line[c].len > 19 && memcmp(packet->line[c].ptr, "User-Agent: Gnutella", 20) == 0) || (packet->line[c].len > 10 && memcmp(packet->line[c].ptr, "X-Gnutella-", 11) == 0) || (packet->line[c].len > 7 && memcmp(packet->line[c].ptr, "X-Queue:", 8) == 0) || (packet->line[c].len > 36 && memcmp(packet->line[c].ptr, "Content-Type: application/x-gnutella-", 37) == 0)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "DETECTED GNUTELLA GET.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } } } if (packet->payload_packet_len > 50 && ((memcmp(packet->payload, "GET / HTTP", 9) == 0))) { ndpi_parse_packet_line_info(ndpi_struct, flow); if ((packet->user_agent_line.ptr != NULL && packet->user_agent_line.len > 15 && memcmp(packet->user_agent_line.ptr, "BearShare Lite ", 15) == 0) || (packet->accept_line.ptr != NULL && packet->accept_line.len > 24 && memcmp(packet->accept_line.ptr, "application n/x-gnutella", 24) == 0)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "DETECTED GNUTELLA GET.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); } } /* haven't found this pattern in any trace. */ if (packet->payload_packet_len > 50 && ((memcmp(packet->payload, "GET /get/", 9) == 0) || (memcmp(packet->payload, "GET /uri-res/", 13) == 0))) { c = 8; while (c < (packet->payload_packet_len - 9)) { if (packet->payload[c] == '?') break; c++; } if (c < (packet->payload_packet_len - 9) && memcmp(&packet->payload[c], "urn:sha1:", 9) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "detected GET /get/ or GET /uri-res/.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); } } /* answer to this packet is HTTP/1.1 ..... Content-Type: application/x-gnutella-packets, * it is searched in the upper paragraph. */ if (packet->payload_packet_len > 30 && memcmp(packet->payload, "HEAD /gnutella/push-proxy?", 26) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "detected HEAD /gnutella/push-proxy?\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } /* haven't found any trace with this pattern */ if (packet->payload_packet_len == 46 && memcmp(packet->payload, "\x50\x55\x53\x48\x20\x67\x75\x69\x64\x3a", 10) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "detected \x50\x55\x53\x48\x20\x67\x75\x69\x64\x3a\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } /* haven't found any trace with this pattern */ if (packet->payload_packet_len > 250 && memcmp(packet->payload, "GET /gnutella/", 14) == 0) //PATTERN IS :: GET /gnutella/tigertree/v3?urn:tree:tiger/: { const u_int16_t end = packet->payload_packet_len - 3; c = 13; while (c < end) { if ((memcmp(&packet->payload[14], "tigertree/", 10) == 0) || (end - c > 18 && memcmp(&packet->payload[c], "\r\nUser-Agent: Foxy", 18) == 0) || (end - c > 44 && memcmp(&packet->payload[c], "\r\nAccept: application/tigertree-breadthfirst", 44) == 0) || (end - c > 10 && memcmp(&packet->payload[c], "\r\nX-Queue:", 10) == 0) || (end - c > 13 && memcmp(&packet->payload[c], "\r\nX-Features:", 13) == 0)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "FOXY :: GNUTELLA GET 2 DETECTED\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } c++; } } /* haven't found any trace with this pattern */ if (packet->payload_packet_len > 1 && packet->payload[packet->payload_packet_len - 1] == 0x0a && packet->payload[packet->payload_packet_len - 2] == 0x0a) { if (packet->payload_packet_len > 3 && memcmp(packet->payload, "GIV", 3) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "MORPHEUS GIV DETECTED\n"); /* Not Excluding the flow now.. We shall Check the next Packet too for Gnutella Patterns */ return; } } /* might be super tricky new ssl gnutella transmission, but the certificate is strange... */ if (packet->payload_packet_len == 46 && get_u_int32_t(packet->payload, 0) == htonl(0x802c0103) && get_u_int32_t(packet->payload, 4) == htonl(0x01000300) && get_u_int32_t(packet->payload, 8) == htonl(0x00002000) && get_u_int16_t(packet->payload, 12) == htons(0x0034)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "detected gnutella len == 46.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 49 && memcmp(packet->payload, "\x80\x2f\x01\x03\x01\x00\x06\x00\x00\x00\x20\x00\x00\x34\x00\x00\xff\x4d\x6c", 19) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "detected gnutella len == 49.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 89 && memcmp(&packet->payload[43], "\x20\x4d\x6c", 3) == 0 && memcmp(packet->payload, "\x16\x03\x01\x00\x54\x01\x00\x00\x50\x03\x01\x4d\x6c", 13) == 0 && memcmp(&packet->payload[76], "\x00\x02\x00\x34\x01\x00\x00\x05", 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "detected gnutella asymmetrically len == 388.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } else if (packet->payload_packet_len == 82) { if (get_u_int32_t(packet->payload, 0) == htonl(0x16030100) && get_u_int32_t(packet->payload, 4) == htonl(0x4d010000) && get_u_int16_t(packet->payload, 8) == htons(0x4903) && get_u_int16_t(packet->payload, 76) == htons(0x0002) && get_u_int32_t(packet->payload, 78) == htonl(0x00340100)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "detected len == 82.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } } } else if (packet->udp != NULL) { if (src != NULL && (packet->udp->source == src->detected_gnutella_udp_port1 || packet->udp->source == src->detected_gnutella_udp_port2) && (packet->tick_timestamp - src->gnutella_ts) < ndpi_struct->gnutella_timeout) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "port based detection\n\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); } /* observations: * all the following patterns send out many packets which are the only ones of their flows, * often on the very beginning of the traces, or flows with many packets in one direction only. * but then suddenly, one gets an answer as you can see in netpeker-gnutella-rpc.pcap packet 11483. * Maybe gnutella tries to send out keys? */ if (packet->payload_packet_len == 23 && packet->payload[15] == 0x00 && packet->payload[16] == 0x41 && packet->payload[17] == 0x01 && packet->payload[18] == 0x00 && packet->payload[19] == 0x00 && packet->payload[20] == 0x00 && packet->payload[21] == 0x00 && packet->payload[22] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, len = 23.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 35 && packet->payload[25] == 0x49 && packet->payload[26] == 0x50 && packet->payload[27] == 0x40 && packet->payload[28] == 0x83 && packet->payload[29] == 0x53 && packet->payload[30] == 0x43 && packet->payload[31] == 0x50 && packet->payload[32] == 0x41) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, len = 35.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 32 && (memcmp(&packet->payload[16], "\x31\x01\x00\x09\x00\x00\x00\x4c\x49\x4d\x45", 11) == 0)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, len = 32.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 34 && (memcmp(&packet->payload[25], "SCP@", 4) == 0) && (memcmp(&packet->payload[30], "DNA@", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, len = 34.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if ((packet->payload_packet_len == 73 || packet->payload_packet_len == 96) && memcmp(&packet->payload[32], "urn:sha1:", 9) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, len = 73,96.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len >= 3 && memcmp(packet->payload, "GND", 3) == 0) { if ((packet->payload_packet_len == 8 && (memcmp(&packet->payload[6], "\x01\x00", 2) == 0)) || (packet->payload_packet_len == 11 && (memcmp(&packet->payload[6], "\x01\x01\x08\x50\x49", 5) == 0)) || (packet->payload_packet_len == 17 && (memcmp (&packet->payload[6], "\x01\x01\x4c\x05\x50", 5) == 0)) || (packet->payload_packet_len == 28 && (memcmp(&packet->payload[6], "\x01\x01\x54\x0f\x51\x4b\x52\x50\x06\x52", 10) == 0)) || (packet->payload_packet_len == 41 && (memcmp(&packet->payload[6], "\x01\x01\x5c\x1b\x50\x55\x53\x48\x48\x10", 10) == 0)) || (packet->payload_packet_len > 200 && packet->payload_packet_len < 300 && packet->payload[3] == 0x03) || (packet->payload_packet_len > 300 && (packet->payload[3] == 0x01 || packet->payload[3] == 0x03))) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, GND.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } } if ((packet->payload_packet_len == 32) && memcmp(&packet->payload[16], "\x31\x01\x00\x09\x00\x00\x00", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, len = 32 ii.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } if ((packet->payload_packet_len == 23) && memcmp(&packet->payload[16], "\x00\x01\x00\x00\x00\x00\x00", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_DEBUG, "detected gnutella udp, len = 23 ii.\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } } //neonet detection follows /* haven't found any trace with this pattern */ if (packet->tcp != NULL && ntohs(packet->tcp->source) >= 1024 && ntohs(packet->tcp->dest) >= 1024) { if (flow->l4.tcp.gnutella_stage == 0) { if (flow->packet_counter == 1 && (packet->payload_packet_len == 11 || packet->payload_packet_len == 33 || packet->payload_packet_len == 37)) { flow->l4.tcp.gnutella_msg_id[0] = packet->payload[4]; flow->l4.tcp.gnutella_msg_id[1] = packet->payload[6]; flow->l4.tcp.gnutella_msg_id[2] = packet->payload[8]; flow->l4.tcp.gnutella_stage = 1 + packet->packet_direction; return; } } else if (flow->l4.tcp.gnutella_stage == 1 + packet->packet_direction) { if (flow->packet_counter == 2 && (packet->payload_packet_len == 33 || packet->payload_packet_len == 22) && flow->l4.tcp.gnutella_msg_id[0] == packet->payload[0] && flow->l4.tcp.gnutella_msg_id[1] == packet->payload[2] && flow->l4.tcp.gnutella_msg_id[2] == packet->payload[4] && NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_GNUTELLA)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "GNUTELLA DETECTED due to message ID match (NEONet protocol)\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } } else if (flow->l4.tcp.gnutella_stage == 2 - packet->packet_direction) { if (flow->packet_counter == 2 && (packet->payload_packet_len == 10 || packet->payload_packet_len == 75) && flow->l4.tcp.gnutella_msg_id[0] == packet->payload[0] && flow->l4.tcp.gnutella_msg_id[1] == packet->payload[2] && flow->l4.tcp.gnutella_msg_id[2] == packet->payload[4] && NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_GNUTELLA)) { NDPI_LOG(NDPI_PROTOCOL_GNUTELLA, ndpi_struct, NDPI_LOG_TRACE, "GNUTELLA DETECTED due to message ID match (NEONet protocol)\n"); ndpi_int_gnutella_add_connection(ndpi_struct, flow); return; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_GNUTELLA); } void init_gnutella_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Gnutella", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_GNUTELLA, ndpi_search_gnutella, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/gtp.c000066400000000000000000000057001321103654100164640ustar00rootroot00000000000000/* * gtp.c * * Copyright (C) 2011-15 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_GTP struct gtp_header_generic { u_int8_t flags, message_type; u_int16_t message_len; u_int32_t teid; }; static void ndpi_check_gtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if((packet->udp != NULL) && (payload_len > sizeof(struct gtp_header_generic))) { u_int32_t gtp_u = ntohs(2152); u_int32_t gtp_c = ntohs(2123); u_int32_t gtp_v0 = ntohs(3386); if((packet->udp->source == gtp_u) || (packet->udp->dest == gtp_u) || (packet->udp->source == gtp_c) || (packet->udp->dest == gtp_c) || (packet->udp->source == gtp_v0) || (packet->udp->dest == gtp_v0) ) { struct gtp_header_generic *gtp = (struct gtp_header_generic*)packet->payload; u_int8_t gtp_version = (gtp->flags & 0xE0) >> 5; if((gtp_version == 0) || (gtp_version == 1) || (gtp_version == 2)) { u_int16_t message_len = ntohs(gtp->message_len); if(message_len <= (payload_len-sizeof(struct gtp_header_generic))) { NDPI_LOG(NDPI_PROTOCOL_GTP, ndpi_struct, NDPI_LOG_DEBUG, "Found gtp.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GTP, NDPI_PROTOCOL_UNKNOWN); return; } } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_GTP); return; } void ndpi_search_gtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_GTP, ndpi_struct, NDPI_LOG_DEBUG, "gtp detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_GTP) ndpi_check_gtp(ndpi_struct, flow); } void init_gtp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("GTP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_GTP, ndpi_search_gtp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/guildwars.c000066400000000000000000000063641321103654100177020ustar00rootroot00000000000000/* * guildwars.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_GUILDWARS static void ndpi_int_guildwars_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_GUILDWARS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_guildwars_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_GUILDWARS, ndpi_struct, NDPI_LOG_DEBUG, "search guildwars.\n"); if (packet->payload_packet_len == 64 && get_u_int16_t(packet->payload, 1) == ntohs(0x050c) && memcmp(&packet->payload[50], "@2&P", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_GUILDWARS, ndpi_struct, NDPI_LOG_DEBUG, "GuildWars version 29.350: found.\n"); ndpi_int_guildwars_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 16 && get_u_int16_t(packet->payload, 1) == ntohs(0x040c) && get_u_int16_t(packet->payload, 4) == ntohs(0xa672) && packet->payload[8] == 0x01 && packet->payload[12] == 0x04) { NDPI_LOG(NDPI_PROTOCOL_GUILDWARS, ndpi_struct, NDPI_LOG_DEBUG, "GuildWars version 29.350: found.\n"); ndpi_int_guildwars_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 21 && get_u_int16_t(packet->payload, 0) == ntohs(0x0100) && get_u_int32_t(packet->payload, 5) == ntohl(0xf1001000) && packet->payload[9] == 0x01) { NDPI_LOG(NDPI_PROTOCOL_GUILDWARS, ndpi_struct, NDPI_LOG_DEBUG, "GuildWars version 216.107.245.50: found.\n"); ndpi_int_guildwars_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_GUILDWARS, ndpi_struct, NDPI_LOG_DEBUG, "exclude guildwars.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_GUILDWARS); } void init_guildwars_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Guildwars", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_GUILDWARS, ndpi_search_guildwars_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/h323.c000066400000000000000000000072531321103654100163560ustar00rootroot00000000000000/* * h323.c * * Copyright (C) 2015 ntop.org * Copyright (C) 2013 Remy Mudingay * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_H323 struct tpkt { u_int8_t version, reserved; u_int16_t len; }; void ndpi_search_h323(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport = 0, sport = 0; NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "search H323.\n"); if(packet->tcp != NULL) { NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "calculated dport over tcp.\n"); /* H323 */ if(packet->payload_packet_len >= 3 && (packet->payload[0] == 0x03) && (packet->payload[1] == 0x00) && (packet->payload[2] == 0x00)) { struct tpkt *t = (struct tpkt*)packet->payload; u_int16_t len = ntohs(t->len); if(packet->payload_packet_len == len) { /* We need to check if this packet is in reality a RDP (Remote Desktop) packet encapsulated on TPTK */ if(packet->payload[4] == (packet->payload_packet_len - sizeof(struct tpkt) - 1)) { /* ISO 8073/X.224 */ if((packet->payload[5] == 0xE0 /* CC Connect Request */) || (packet->payload[5] == 0xD0 /* CC Connect Confirm */)) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RDP, NDPI_PROTOCOL_UNKNOWN); return; } } flow->l4.tcp.h323_valid_packets++; if(flow->l4.tcp.h323_valid_packets >= 2) { NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "found H323 broadcast.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_H323, NDPI_PROTOCOL_UNKNOWN); } } else { /* This is not H.323 */ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_H323); } } } else if(packet->udp != NULL) { sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest); NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "calculated dport over udp.\n"); if(packet->payload_packet_len >= 6 && packet->payload[0] == 0x80 && packet->payload[1] == 0x08 && (packet->payload[2] == 0xe7 || packet->payload[2] == 0x26) && packet->payload[4] == 0x00 && packet->payload[5] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "found H323 broadcast.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_H323, NDPI_PROTOCOL_UNKNOWN); return; } /* H323 */ if(sport == 1719 || dport == 1719) { if(packet->payload[0] == 0x16 && packet->payload[1] == 0x80 && packet->payload[4] == 0x06 && packet->payload[5] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "found H323 broadcast.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_H323, NDPI_PROTOCOL_UNKNOWN); return; } else if(packet->payload_packet_len >= 20 && packet->payload_packet_len <= 117) { NDPI_LOG(NDPI_PROTOCOL_H323, ndpi_struct, NDPI_LOG_DEBUG, "found H323 broadcast.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_H323, NDPI_PROTOCOL_UNKNOWN); return; } else { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_H323); return; } } } } void init_h323_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("H323", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_H323, ndpi_search_h323, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/halflife2_and_mods.c000066400000000000000000000055501321103654100213750ustar00rootroot00000000000000/* * halflife2_and_mods.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_HALFLIFE2 static void ndpi_int_halflife2_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HALFLIFE2, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_halflife2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (flow->l4.udp.halflife2_stage == 0) { if (packet->payload_packet_len >= 20 && get_u_int32_t(packet->payload, 0) == 0xFFFFFFFF && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) == htonl(0x30303000)) { flow->l4.udp.halflife2_stage = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_HALFLIFE2, ndpi_struct, NDPI_LOG_DEBUG, "halflife2 client req detected, waiting for server reply\n"); return; } } else if (flow->l4.udp.halflife2_stage == 2 - packet->packet_direction) { if (packet->payload_packet_len >= 20 && get_u_int32_t(packet->payload, 0) == 0xFFFFFFFF && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) == htonl(0x30303000)) { ndpi_int_halflife2_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_HALFLIFE2, ndpi_struct, NDPI_LOG_DEBUG, "halflife2 server reply detected\n"); return; } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HALFLIFE2); } void init_halflife2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("HalfLife2", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_HALFLIFE2, ndpi_search_halflife2, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/hangout.c000066400000000000000000000071361321103654100173440ustar00rootroot00000000000000/* * hangout.c * * Copyright (C) 2012-16 - ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_HANGOUT /* https://support.google.com/a/answer/1279090?hl=en */ #define HANGOUT_UDP_LOW_PORT 19302 #define HANGOUT_UDP_HIGH_PORT 19309 #define HANGOUT_TCP_LOW_PORT 19305 #define HANGOUT_TCP_HIGH_PORT 19309 /* ***************************************************************** */ static u_int8_t isHangoutUDPPort(u_int16_t port) { if((port >= HANGOUT_UDP_LOW_PORT) && (port <= HANGOUT_UDP_HIGH_PORT)) return(1); else return(0); } /* ***************************************************************** */ static u_int8_t isHangoutTCPPort(u_int16_t port) { if((port >= HANGOUT_TCP_LOW_PORT) && (port <= HANGOUT_TCP_HIGH_PORT)) return(1); else return(0); } /* ******************************************* */ static u_int8_t google_ptree_match(struct ndpi_detection_module_struct *ndpi_struct, struct in_addr *pin) { return((ndpi_network_ptree_match(ndpi_struct, pin) == NDPI_PROTOCOL_GOOGLE) ? 1 : 0); } /* ******************************************* */ static u_int8_t is_google_flow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->iph) { if(google_ptree_match(ndpi_struct, (struct in_addr *)&packet->iph->saddr) || google_ptree_match(ndpi_struct, (struct in_addr *)&packet->iph->daddr)) { return(1); } } return(0); } /* ***************************************************************** */ void ndpi_search_hangout(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct * packet = &flow->packet; if((packet->payload_packet_len > 24) && is_google_flow(ndpi_struct, flow)) { if( ((packet->udp != NULL) && (isHangoutUDPPort(ntohs(packet->udp->source)) || isHangoutUDPPort(ntohs(packet->udp->dest)))) || ((packet->tcp != NULL) && (isHangoutTCPPort(ntohs(packet->tcp->source)) || isHangoutTCPPort(ntohs(packet->tcp->dest))))) { NDPI_LOG(NDPI_PROTOCOL_HANGOUT, ndpi_struct, NDPI_LOG_DEBUG, "Found Hangout.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HANGOUT, NDPI_PROTOCOL_UNKNOWN); return; } } NDPI_LOG(NDPI_PROTOCOL_HANGOUT, ndpi_struct, NDPI_LOG_DEBUG, "No Hangout.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HANGOUT); } /* ***************************************************************** */ void init_hangout_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("GoogleHangout", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_HANGOUT, ndpi_search_hangout, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif /* NDPI_PROTOCOL_HANGOUT */ nDPI-2.2/src/lib/protocols/hep.c000066400000000000000000000045541321103654100164540ustar00rootroot00000000000000/* * hep.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * Copyright (C) 2011-15 - QXIP BV * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_HEP static void ndpi_int_hep_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HEP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_hep(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; NDPI_LOG(NDPI_PROTOCOL_HEP, ndpi_struct, NDPI_LOG_DEBUG, "searching for HEP.\n"); if (payload_len > 10) { if (memcmp(packet_payload, "HEP3", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_HEP, ndpi_struct, NDPI_LOG_DEBUG, "found HEP3.\n"); ndpi_int_hep_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_HEP, ndpi_struct, NDPI_LOG_DEBUG, "exclude HEP.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HEP); } void init_hep_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("HEP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_HEP, ndpi_search_hep, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/http.c000066400000000000000000001167351321103654100166640ustar00rootroot00000000000000/* * http.c * * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_HTTP /* global variables used for 1kxun protocol and iqiyi service */ static void ndpi_int_http_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int32_t protocol) { if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { /* This is HTTP and it is not a sub protocol (e.g. skype or dropbox) */ ndpi_search_tcp_or_udp(ndpi_struct, flow); /* If no custom protocol has been detected */ /* if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) */ if(protocol == NDPI_PROTOCOL_HTTP) { ndpi_int_reset_protocol(flow); ndpi_set_detected_protocol(ndpi_struct, flow, flow->guessed_host_protocol_id, protocol); } else ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_HTTP); flow->http_detected = 1; } } #ifdef NDPI_CONTENT_FLASH static void flash_check_http_payload(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; const u_int8_t *pos; if(packet->empty_line_position_set == 0 || (packet->empty_line_position + 10) > (packet->payload_packet_len)) return; pos = &packet->payload[packet->empty_line_position] + 2; if(memcmp(pos, "FLV", 3) == 0 && pos[3] == 0x01 && (pos[4] == 0x01 || pos[4] == 0x04 || pos[4] == 0x05) && pos[5] == 0x00 && pos[6] == 0x00 && pos[7] == 0x00 && pos[8] == 0x09) { NDPI_LOG(NDPI_CONTENT_FLASH, ndpi_struct, NDPI_LOG_DEBUG, "Flash content in HTTP detected\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_CONTENT_FLASH); } } #endif #ifdef NDPI_CONTENT_AVI static void avi_check_http_payload(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_CONTENT_AVI, ndpi_struct, NDPI_LOG_DEBUG, "called avi_check_http_payload: %u %u %u\n", packet->empty_line_position_set, flow->l4.tcp.http_empty_line_seen, packet->empty_line_position); if(packet->empty_line_position_set == 0 && flow->l4.tcp.http_empty_line_seen == 0) return; if(packet->empty_line_position_set != 0 && ((packet->empty_line_position + 20) > (packet->payload_packet_len)) && flow->l4.tcp.http_empty_line_seen == 0) { flow->l4.tcp.http_empty_line_seen = 1; return; } if(flow->l4.tcp.http_empty_line_seen == 1) { if(packet->payload_packet_len > 20 && memcmp(packet->payload, "RIFF", 4) == 0 && memcmp(packet->payload + 8, "AVI LIST", 8) == 0) { NDPI_LOG(NDPI_CONTENT_AVI, ndpi_struct, NDPI_LOG_DEBUG, "Avi content in HTTP detected\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_CONTENT_AVI); } flow->l4.tcp.http_empty_line_seen = 0; return; } /** for reference see http://msdn.microsoft.com/archive/default.asp?url=/archive/en-us/directx9_c/directx/htm/avirifffilereference.asp **/ if(packet->empty_line_position_set != 0) { u_int32_t p = packet->empty_line_position + 2; // check for avi header NDPI_LOG(NDPI_CONTENT_AVI, ndpi_struct, NDPI_LOG_DEBUG, "p = %u\n", p); if((p + 16) <= packet->payload_packet_len && memcmp(&packet->payload[p], "RIFF", 4) == 0 && memcmp(&packet->payload[p + 8], "AVI LIST", 8) == 0) { NDPI_LOG(NDPI_CONTENT_AVI, ndpi_struct, NDPI_LOG_DEBUG, "Avi content in HTTP detected\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_CONTENT_AVI); } } } #endif #ifdef NDPI_PROTOCOL_TEAMVIEWER static void teamviewer_check_http_payload(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; const u_int8_t *pos; NDPI_LOG(NDPI_PROTOCOL_TEAMVIEWER, ndpi_struct, NDPI_LOG_DEBUG, "called teamviewer_check_http_payload: %u %u %u\n", packet->empty_line_position_set, flow->l4.tcp.http_empty_line_seen, packet->empty_line_position); if(packet->empty_line_position_set == 0 || (packet->empty_line_position + 5) > (packet->payload_packet_len)) return; pos = &packet->payload[packet->empty_line_position] + 2; if(pos[0] == 0x17 && pos[1] == 0x24) { NDPI_LOG(NDPI_PROTOCOL_TEAMVIEWER, ndpi_struct, NDPI_LOG_DEBUG, "TeamViewer content in HTTP detected\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_TEAMVIEWER); } } #endif #ifdef NDPI_PROTOCOL_RTSP static void rtsp_parse_packet_acceptline(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->accept_line.len >= 28 && memcmp(packet->accept_line.ptr, "application/x-rtsp-tunnelled", 28) == 0) { NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_DEBUG, "RTSP accept line detected\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_RTSP); } } #endif static void setHttpUserAgent(struct ndpi_flow_struct *flow, char *ua) { if ( !strcmp(ua, "Windows NT 5.0")) ua = "Windows 2000"; else if(!strcmp(ua, "Windows NT 5.1")) ua = "Windows XP"; else if(!strcmp(ua, "Windows NT 5.2")) ua = "Windows Server 2003"; else if(!strcmp(ua, "Windows NT 6.0")) ua = "Windows Vista"; else if(!strcmp(ua, "Windows NT 6.1")) ua = "Windows 7"; else if(!strcmp(ua, "Windows NT 6.2")) ua = "Windows 8"; else if(!strcmp(ua, "Windows NT 6.3")) ua = "Windows 8.1"; else if(!strcmp(ua, "Windows NT 10.0")) ua = "Windows 10"; /* Good reference for future implementations: * https://github.com/ua-parser/uap-core/blob/master/regexes.yaml */ //printf("==> %s\n", ua); snprintf((char*)flow->protos.http.detected_os, sizeof(flow->protos.http.detected_os), "%s", ua); } static void parseHttpSubprotocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { if((flow->l4.tcp.http_stage == 0) || (flow->http.url && flow->http_detected)) { char *double_col = strchr((char*)flow->host_server_name, ':'); if(double_col) double_col[0] = '\0'; /** NOTE If http_dont_dissect_response = 1 dissection of HTTP response mime types won't happen */ ndpi_match_host_subprotocol(ndpi_struct, flow, (char *)flow->host_server_name, strlen((const char *)flow->host_server_name), NDPI_PROTOCOL_HTTP); } } /** NOTE ndpi_parse_packet_line_info is in ndpi_main.c */ static void check_content_type_and_change_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int8_t a; #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI) /* PPStream */ if(flow->l4.tcp.ppstream_stage > 0 && flow->iqiyi_counter == 0) { NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "PPStream found.\n"); /* ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_PPSTREAM); */ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_HTTP); } else if(flow->iqiyi_counter > 0) { NDPI_LOG(NDPI_PROTOCOL_IQIYI, ndpi_struct, NDPI_LOG_DEBUG, "iQiyi found.\n"); /* ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_IQIYI); */ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IQIYI, NDPI_PROTOCOL_HTTP); } #endif #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI) /* 1KXUN */ if(flow->kxun_counter > 0) { NDPI_LOG(NDPI_PROTOCOL_1KXUN, ndpi_struct, NDPI_LOG_DEBUG, "1kxun found.\n"); /* ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_1KXUN); */ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_1KXUN, NDPI_PROTOCOL_HTTP); } #endif if(!ndpi_struct->http_dont_dissect_response) { if((flow->http.url == NULL) && (packet->http_url_name.len > 0) && (packet->host_line.len > 0)) { int len = packet->http_url_name.len + packet->host_line.len + 7 + 1; /* "http://" */ flow->http.url = ndpi_malloc(len); if(flow->http.url) { strncpy(flow->http.url, "http://", 7); strncpy(&flow->http.url[7], (char*)packet->host_line.ptr, packet->host_line.len); strncpy(&flow->http.url[7+packet->host_line.len], (char*)packet->http_url_name.ptr, packet->http_url_name.len); flow->http.url[len-1] = '\0'; } if(flow->packet.http_method.len < 3) flow->http.method = HTTP_METHOD_UNKNOWN; else { switch(flow->packet.http_method.ptr[0]) { case 'O': flow->http.method = HTTP_METHOD_OPTIONS; break; case 'G': flow->http.method = HTTP_METHOD_GET; break; case 'H': flow->http.method = HTTP_METHOD_HEAD; break; case 'P': switch(flow->packet.http_method.ptr[1]) { case 'O': flow->http.method = HTTP_METHOD_POST; break; case 'U': flow->http.method = HTTP_METHOD_PUT; break; } break; case 'D': flow->http.method = HTTP_METHOD_DELETE; break; case 'T': flow->http.method = HTTP_METHOD_TRACE; break; case 'C': flow->http.method = HTTP_METHOD_CONNECT; break; default: flow->http.method = HTTP_METHOD_UNKNOWN; break; } } } if((flow->http.content_type == NULL) && (packet->content_line.len > 0)) { int len = packet->content_line.len + 1; flow->http.content_type = ndpi_malloc(len); if(flow->http.content_type) { strncpy(flow->http.content_type, (char*)packet->content_line.ptr, packet->content_line.len); flow->http.content_type[packet->content_line.len] = '\0'; } } } if(packet->user_agent_line.ptr != NULL && packet->user_agent_line.len != 0) { /** Format examples: Mozilla/5.0 (iPad; U; CPU OS 3_2 like Mac OS X; en-us) AppleWebKit/531.21.10 (KHTML, like Gecko) .... Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:54.0) Gecko/20100101 Firefox/54.0 */ if(packet->user_agent_line.len > 7) { char ua[256]; u_int mlen = ndpi_min(packet->user_agent_line.len, sizeof(ua)-1); strncpy(ua, (const char *)packet->user_agent_line.ptr, mlen); ua[mlen] = '\0'; if(strncmp(ua, "Mozilla", 7) == 0) { char *parent = strchr(ua, '('); if(parent) { char *token, *end; parent++; end = strchr(parent, ')'); if(end) end[0] = '\0'; token = strsep(&parent, ";"); if(token) { if((strcmp(token, "X11") == 0) || (strcmp(token, "compatible") == 0) || (strcmp(token, "Linux") == 0) || (strcmp(token, "Macintosh") == 0) ) { token = strsep(&parent, ";"); if(token && (token[0] == ' ')) token++; /* Skip space */ if(token && ((strcmp(token, "U") == 0) || (strncmp(token, "MSIE", 4) == 0))) { token = strsep(&parent, ";"); if(token && (token[0] == ' ')) token++; /* Skip space */ if(token && (strncmp(token, "Update", 6) == 0)) { token = strsep(&parent, ";"); if(token && (token[0] == ' ')) token++; /* Skip space */ if(token && (strncmp(token, "AOL", 3) == 0)) { token = strsep(&parent, ";"); if(token && (token[0] == ' ')) token++; /* Skip space */ } } } } if(token) setHttpUserAgent(flow, token); } } } else if(memcmp(ua, "netflix-ios-app", 15) == 0) { ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_NETFLIX); return; } } NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "User Agent Type line found %.*s\n", packet->user_agent_line.len, packet->user_agent_line.ptr); } /* check for host line */ if(packet->host_line.ptr != NULL) { u_int len; NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HOST line found %.*s\n", packet->host_line.len, packet->host_line.ptr); /* call ndpi_match_host_subprotocol to see if there is a match with known-host HTTP subprotocol */ if((ndpi_struct->http_dont_dissect_response) || flow->http_detected) ndpi_match_host_subprotocol(ndpi_struct, flow, (char*)packet->host_line.ptr, packet->host_line.len, NDPI_PROTOCOL_HTTP); /* Copy result for nDPI apps */ len = ndpi_min(packet->host_line.len, sizeof(flow->host_server_name)-1); strncpy((char*)flow->host_server_name, (char*)packet->host_line.ptr, len); flow->host_server_name[len] = '\0', flow->server_id = flow->dst; if(packet->forwarded_line.ptr) { len = ndpi_min(packet->forwarded_line.len, sizeof(flow->protos.http.nat_ip)-1); strncpy((char*)flow->protos.http.nat_ip, (char*)packet->forwarded_line.ptr, len); flow->protos.http.nat_ip[len] = '\0'; } if(ndpi_struct->http_dont_dissect_response) parseHttpSubprotocol(ndpi_struct, flow); /** check result of host subprotocol detection if "detected" in flow == 0 then "detected" = "guess" else "guess" = "detected" **/ if(flow->detected_protocol_stack[1] == 0) { flow->detected_protocol_stack[1] = flow->guessed_protocol_id; if(flow->detected_protocol_stack[0] == 0) flow->detected_protocol_stack[0] = flow->guessed_host_protocol_id; } else { if(flow->detected_protocol_stack[1] != flow->guessed_protocol_id) flow->guessed_protocol_id = flow->detected_protocol_stack[1]; if(flow->detected_protocol_stack[0] != flow->guessed_host_protocol_id) flow->guessed_host_protocol_id = flow->detected_protocol_stack[0]; } if((flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) && ((ndpi_struct->http_dont_dissect_response) || flow->http_detected) && (packet->http_origin.len > 0)) ndpi_match_host_subprotocol(ndpi_struct, flow, (char *)packet->http_origin.ptr, packet->http_origin.len, NDPI_PROTOCOL_HTTP); if(flow->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_HTTP) { ndpi_int_http_add_connection(ndpi_struct, flow, packet->detected_protocol_stack[0]); return; /* We have identified a sub-protocol so we're done */ } } } if(!ndpi_struct->http_dont_dissect_response && flow->http_detected) parseHttpSubprotocol(ndpi_struct, flow); if(flow->guessed_protocol_id == NDPI_PROTOCOL_UNKNOWN) flow->guessed_protocol_id = NDPI_PROTOCOL_HTTP; /* check for accept line */ if(packet->accept_line.ptr != NULL) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Accept line found %.*s\n", packet->accept_line.len, packet->accept_line.ptr); #ifdef NDPI_PROTOCOL_RTSP if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask, NDPI_PROTOCOL_RTSP) != 0) { rtsp_parse_packet_acceptline(ndpi_struct, flow); } #endif } /* search for line startin with "Icy-MetaData" */ #ifdef NDPI_CONTENT_MPEG for (a = 0; a < packet->parsed_lines; a++) { if(packet->line[a].len > 11 && memcmp(packet->line[a].ptr, "Icy-MetaData", 12) == 0) { NDPI_LOG(NDPI_CONTENT_MPEG, ndpi_struct, NDPI_LOG_DEBUG, "MPEG: Icy-MetaData found.\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_CONTENT_MPEG); return; } } #ifdef NDPI_CONTENT_AVI #endif #endif if(packet->content_line.ptr != NULL && packet->content_line.len != 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Content Type line found %.*s\n", packet->content_line.len, packet->content_line.ptr); if((ndpi_struct->http_dont_dissect_response) || flow->http_detected) ndpi_match_content_subprotocol(ndpi_struct, flow, (char*)packet->content_line.ptr, packet->content_line.len, NDPI_PROTOCOL_HTTP); } } static void check_http_payload(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "called check_http_payload.\n"); #ifdef NDPI_CONTENT_FLASH if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask, NDPI_CONTENT_FLASH) != 0) flash_check_http_payload(ndpi_struct, flow); #endif #ifdef NDPI_CONTENT_AVI if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask, NDPI_CONTENT_AVI) != 0) avi_check_http_payload(ndpi_struct, flow); #endif #ifdef NDPI_PROTOCOL_TEAMVIEWER teamviewer_check_http_payload(ndpi_struct, flow); #endif } /** * Functions to check whether the packet begins with a valid http request * @param ndpi_struct * @returnvalue 0 if no valid request has been found * @returnvalue >0 indicates start of filename but not necessarily in packet limit */ static u_int16_t http_request_url_offset(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> HTTP: %c%c%c%c [len: %u]\n", packet->payload[0], packet->payload[1], packet->payload[2], packet->payload[3], packet->payload_packet_len); /** FIRST PAYLOAD PACKET FROM CLIENT **/ /* check if the packet starts with POST or GET */ if(packet->payload_packet_len >= 4 && memcmp(packet->payload, "GET ", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: GET FOUND\n"); return 4; } else if(packet->payload_packet_len >= 5 && memcmp(packet->payload, "POST ", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: POST FOUND\n"); return 5; } else if(packet->payload_packet_len >= 8 && memcmp(packet->payload, "OPTIONS ", 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: OPTIONS FOUND\n"); return 8; } else if(packet->payload_packet_len >= 5 && memcmp(packet->payload, "HEAD ", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: HEAD FOUND\n"); return 5; } else if(packet->payload_packet_len >= 4 && memcmp(packet->payload, "PUT ", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: PUT FOUND\n"); return 4; } else if(packet->payload_packet_len >= 7 && memcmp(packet->payload, "DELETE ", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: DELETE FOUND\n"); return 7; } else if(packet->payload_packet_len >= 8 && memcmp(packet->payload, "CONNECT ", 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: CONNECT FOUND\n"); return 8; } else if(packet->payload_packet_len >= 9 && memcmp(packet->payload, "PROPFIND ", 9) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: PROFIND FOUND\n"); return 9; } else if(packet->payload_packet_len >= 7 && memcmp(packet->payload, "REPORT ", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: REPORT FOUND\n"); return 7; } return 0; } static void http_bitmask_exclude(struct ndpi_flow_struct *flow) { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP); #ifdef NDPI_CONTENT_MPEG NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_CONTENT_MPEG); #endif #ifdef NDPI_CONTENT_QUICKTIME NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_CONTENT_QUICKTIME); #endif #ifdef NDPI_CONTENT_WINDOWSMEDIA NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_CONTENT_WINDOWSMEDIA); #endif #ifdef NDPI_CONTENT_REALMEDIA NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_CONTENT_REALMEDIA); #endif #ifdef NDPI_CONTENT_AVI NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_CONTENT_AVI); #endif #ifdef NDPI_CONTENT_OGG NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_CONTENT_OGG); #endif #ifdef NDPI_PROTOCOL_MOVE NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MOVE); #endif #ifdef NDPI_PROTOCOL_XBOX NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_XBOX); #endif } /*************************************************************************************************/ static void ndpi_check_http_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t filename_start; /* the filename in the request method line, e.g., "GET filename_start..."*/ packet->packet_lines_parsed_complete = 0; /* Check if we so far detected the protocol in the request or not. */ if(flow->l4.tcp.http_stage == 0) { /* Expected a request */ flow->http_detected = 0; NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP stage %d: \n", flow->l4.tcp.http_stage); filename_start = http_request_url_offset(ndpi_struct, flow); if(filename_start == 0) { /* not a regular request. In the HTTP first stage, may be a truncated flow or other protocols */ NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Filename HTTP not found, we look for possible truncate flow...\n"); if(packet->payload_packet_len >= 7 && memcmp(packet->payload, "HTTP/1.", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP response found (truncated flow ?)\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); check_content_type_and_change_protocol(ndpi_struct, flow); return; } if((packet->payload_packet_len == 3) && memcmp(packet->payload, "HI\n", 3) == 0) { /* This looks like Ookla: we don't give up with HTTP yet */ flow->l4.tcp.http_stage = 1; return; } if((packet->payload_packet_len == 23) && (memcmp(packet->payload, "", 23) == 0)) { /* */ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_UNKNOWN); return; } NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Exclude HTTP\n"); http_bitmask_exclude(flow); return; } NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Filename HTTP found: %d, we look for line info..\n", filename_start); ndpi_parse_packet_line_info(ndpi_struct, flow); if(packet->parsed_lines <= 1) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Found just one line, we will look further for the next packet...\n"); packet->http_method.ptr = packet->line[0].ptr; packet->http_method.len = filename_start - 1; /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->l4.tcp.http_stage = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 return; } NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Found more than one line, we look further for the next packet...\n"); if(packet->line[0].len >= (9 + filename_start) && memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) == 0) { /* Request line complete. Ex. "GET / HTTP/1.1" */ packet->http_url_name.ptr = &packet->payload[filename_start]; packet->http_url_name.len = packet->line[0].len - (filename_start + 9); packet->http_method.ptr = packet->line[0].ptr; packet->http_method.len = filename_start - 1; // Set the HTTP requested version: 0=HTTP/1.0 and 1=HTTP/1.1 if(memcmp(&packet->line[0].ptr[packet->line[0].len - 1], "1", 1) == 0) flow->http.request_version = 1; else flow->http.request_version = 0; /* Set the first found headers in request */ flow->http.num_request_headers = packet->http_num_headers; /* Check for Ookla */ if((packet->referer_line.len > 0) && ndpi_strnstr((const char *)packet->referer_line.ptr, "www.speedtest.net", packet->referer_line.len)) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_HTTP); return; } /* Check for additional field introduced by Steam */ int x = 1; if((memcmp(packet->line[x].ptr, "x-steam-sid", 11)) == 0) { ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_STEAM); check_content_type_and_change_protocol(ndpi_struct, flow); return; } /* Check for additional field introduced by Facebook */ x = 1; while(packet->line[x].len != 0) { if(packet->line[x].len >= 12 && (memcmp(packet->line[x].ptr, "X-FB-SIM-HNI", 12)) == 0) { ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_FACEBOOK); check_content_type_and_change_protocol(ndpi_struct, flow); return; } x++; } #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI) /* check PPStream protocol or iQiyi service (iqiyi is delivered by ppstream) */ // substring in url if(ndpi_strnstr((const char*) &packet->payload[filename_start], "iqiyi.com", (packet->payload_packet_len - filename_start)) != NULL) { if(flow->kxun_counter == 0) { flow->l4.tcp.ppstream_stage++; flow->iqiyi_counter++; check_content_type_and_change_protocol(ndpi_struct, flow); /* ***** CHECK ****** */ return; } } // additional field in http payload x = 1; while((packet->line[x].len >= 4) && (packet->line[x+1].len >= 5) && (packet->line[x+2].len >= 10)) { if(packet->line[x].ptr && ((memcmp(packet->line[x].ptr, "qyid", 4)) == 0) && packet->line[x+1].ptr && ((memcmp(packet->line[x+1].ptr, "qypid", 5)) == 0) && packet->line[x+2].ptr && ((memcmp(packet->line[x+2].ptr, "qyplatform", 10)) == 0) ) { flow->l4.tcp.ppstream_stage++; flow->iqiyi_counter++; check_content_type_and_change_protocol(ndpi_struct, flow); return; } x++; } #endif #if defined(NDPI_PROTOCOL_1KXUN) || defined(NDPI_PROTOCOL_IQIYI) /* Check for 1kxun packet */ int a; for (a = 0; a < packet->parsed_lines; a++) { if(packet->line[a].len >= 14 && (memcmp(packet->line[a].ptr, "Client-Source:", 14)) == 0) { if((memcmp(packet->line[a].ptr+15, "1kxun", 5)) == 0) { flow->kxun_counter++; check_content_type_and_change_protocol(ndpi_struct, flow); return; } } } #endif if((packet->http_url_name.len > 7) && (!strncmp((const char*) packet->http_url_name.ptr, "http://", 7))) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP_PROXY Found.\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_PROXY); check_content_type_and_change_protocol(ndpi_struct, flow); } if(filename_start == 8 && (memcmp(packet->payload, "CONNECT ", 8) == 0)) { /* nathan@getoffmalawn.com */ NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP_CONNECT Found.\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_CONNECT); check_content_type_and_change_protocol(ndpi_struct, flow); } NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP START Found, we will look for sub-protocols (content and host)...\n"); if(packet->host_line.ptr != NULL) { /** nDPI is pretty scrupulous about HTTP so it waits until the HTTP response is received just to check that it conforms with the HTTP specs. However this might be a waste of time as in 99.99% of the cases is like that. */ if(ndpi_struct->http_dont_dissect_response) { if(flow->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) /* No subprotocol found */ ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); } else { flow->http_detected = 1; NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP START Found, we will look further for the response...\n"); flow->l4.tcp.http_stage = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 } check_content_type_and_change_protocol(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: REQUEST NOT HTTP CONFORM\n"); http_bitmask_exclude(flow); } else if((flow->l4.tcp.http_stage == 1) || (flow->l4.tcp.http_stage == 2)) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP stage %u: \n", flow->l4.tcp.http_stage); if(flow->l4.tcp.http_stage == 1) { if((packet->payload_packet_len > 6) && memcmp(packet->payload, "HELLO ", 6) == 0) { /* This looks like Ookla */ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OOKLA, NDPI_PROTOCOL_UNKNOWN); return; } else NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OOKLA); } /** At first check, if this is for sure a response packet (in another direction. If not, if HTTP is detected do nothing now and return, otherwise check the second packet for the HTTP request */ if((flow->l4.tcp.http_stage - packet->packet_direction) == 1) { /* Expected a response package */ if(flow->http_detected) return; NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, " SECOND PAYLOAD TRAFFIC FROM CLIENT, FIRST PACKET MIGHT HAVE BEEN HTTP...UNKNOWN TRAFFIC, HERE FOR HTTP again.. \n"); ndpi_parse_packet_line_info(ndpi_struct, flow); // Add more found HTTP request headers. flow->http.num_request_headers+=packet->http_num_headers; if(packet->parsed_lines <= 1) { /* wait some packets in case request is split over more than 2 packets */ if(flow->packet_counter < 5) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "line still not finished, search next packet\n"); return; } else { /* stop parsing here */ NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP: PACKET DOES NOT HAVE A LINE STRUCTURE\n"); http_bitmask_exclude(flow); return; } } // http://www.slideshare.net/DSPIP/rtsp-analysis-wireshark if(packet->line[0].len >= 9 && memcmp(&packet->line[0].ptr[packet->line[0].len - 9], " HTTP/1.", 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Found HTTP.\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); check_content_type_and_change_protocol(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP START Found in 2. packet, we will look further for the response....\n"); flow->http_detected = 1; } return; } /** This is a packet in another direction. Check if we find the proper response. We have received a response for a previously identified partial HTTP request */ /* response without headers * TODO: Shouldn't it be below ndpi_parse_packet_line_info, line ~825 ? */ if((packet->parsed_lines == 1) && (packet->packet_direction == 1 /* server -> client */)) { /* In Apache if you do "GET /\n\n" the response comes without any header */ NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Found HTTP. (apache)\n"); ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); check_content_type_and_change_protocol(ndpi_struct, flow); return; } /* If we already detected the HTTP request, we can add the connection and then check for the sub-protocol */ if(flow->http_detected) ndpi_int_http_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_HTTP); /* Parse packet line and we look for the subprotocols */ ndpi_parse_packet_line_info(ndpi_struct, flow); check_content_type_and_change_protocol(ndpi_struct, flow); if(packet->packet_direction == 1 /* server -> client */){ flow->http.num_response_headers += packet->http_num_headers; /* flow structs are initialized with zeros */ } if(packet->empty_line_position_set != 0 || flow->l4.tcp.http_empty_line_seen == 1) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "empty line. check_http_payload.\n"); check_http_payload(ndpi_struct, flow); } flow->l4.tcp.http_stage = 0; return; } } void ndpi_search_http_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* Break after 20 packets. */ if(flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "Exclude HTTP.\n"); http_bitmask_exclude(flow); return; } if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { return; } NDPI_LOG(NDPI_PROTOCOL_HTTP, ndpi_struct, NDPI_LOG_DEBUG, "HTTP detection...\n"); ndpi_check_http_tcp(ndpi_struct, flow); } /* ********************************* */ ndpi_http_method ndpi_get_http_method(struct ndpi_detection_module_struct *ndpi_mod, struct ndpi_flow_struct *flow) { if(!flow) return(HTTP_METHOD_UNKNOWN); else return(flow->http.method); } /* ********************************* */ char* ndpi_get_http_url(struct ndpi_detection_module_struct *ndpi_mod, struct ndpi_flow_struct *flow) { if((!flow) || (!flow->http.url)) return(""); else return(flow->http.url); } /* ********************************* */ char* ndpi_get_http_content_type(struct ndpi_detection_module_struct *ndpi_mod, struct ndpi_flow_struct *flow) { if((!flow) || (!flow->http.content_type)) return(""); else return(flow->http.content_type); } void init_http_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("HTTP",ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_HTTP, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #if 0 ndpi_set_bitmask_protocol_detection("HTTP_Proxy", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_HTTP_PROXY, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #ifdef NDPI_CONTENT_MPEG ndpi_set_bitmask_protocol_detection("MPEG", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_MPEG, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_FLASH ndpi_set_bitmask_protocol_detection("Flash", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_FLASH, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_QUICKTIME ndpi_set_bitmask_protocol_detection("QuickTime", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_QUICKTIME, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_REALMEDIA ndpi_set_bitmask_protocol_detection("RealMedia", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_REALMEDIA, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_WINDOWSMEDIA ndpi_set_bitmask_protocol_detection("WindowsMedia", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_WINDOWSMEDIA, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_MMS ndpi_set_bitmask_protocol_detection("MMS", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_MMS, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_PROTOCOL_XBOX ndpi_set_bitmask_protocol_detection("Xbox", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_XBOX, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_PROTOCOL_QQ ndpi_set_bitmask_protocol_detection("QQ", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_QQ, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_AVI ndpi_set_bitmask_protocol_detection("AVI", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_AVI, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_OGG ndpi_set_bitmask_protocol_detection("OggVorbis", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_OGG, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_PROTOCOL_MOVE ndpi_set_bitmask_protocol_detection("Move", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MOVE, ndpi_search_http_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif /* Update excluded protocol bitmask */ NDPI_BITMASK_SET(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, ndpi_struct->callback_buffer[a].detection_bitmask); /*Delete protocol from excluded protocol bitmask*/ NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_UNKNOWN); NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_QQ); #ifdef NDPI_CONTENT_FLASH NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_CONTENT_FLASH); #endif NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_CONTENT_MMS); NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->callback_buffer[a].excluded_protocol_bitmask, NDPI_PROTOCOL_XBOX); NDPI_BITMASK_SET(ndpi_struct->generic_http_packet_bitmask, ndpi_struct->callback_buffer[a].detection_bitmask); NDPI_DEL_PROTOCOL_FROM_BITMASK(ndpi_struct->generic_http_packet_bitmask, NDPI_PROTOCOL_UNKNOWN); /* Update callback_buffer index */ a++; #endif } #endif nDPI-2.2/src/lib/protocols/http_activesync.c000066400000000000000000000050141321103654100210770ustar00rootroot00000000000000/* * http_activesync.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC static void ndpi_int_activesync_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC, NDPI_PROTOCOL_HTTP); } void ndpi_search_activesync(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->tcp != NULL) { if (packet->payload_packet_len > 150 && ((memcmp(packet->payload, "OPTIONS /Microsoft-Server-ActiveSync?", 37) == 0) || (memcmp(packet->payload, "POST /Microsoft-Server-ActiveSync?", 34) == 0))) { ndpi_int_activesync_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC, ndpi_struct, NDPI_LOG_DEBUG, " flow marked as ActiveSync \n"); return; } } NDPI_LOG(NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC, ndpi_struct, NDPI_LOG_DEBUG, "exclude activesync\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC); } void init_http_activesync_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("HTTP_Application_ActiveSync", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_HTTP_APPLICATION_ACTIVESYNC, ndpi_search_activesync, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/iax.c000066400000000000000000000073061321103654100164570ustar00rootroot00000000000000/* * iax.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_IAX #define NDPI_IAX_MAX_INFORMATION_ELEMENTS 15 static void ndpi_int_iax_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IAX, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_search_setup_iax(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int8_t i; u_int16_t packet_len; if ( /* 1. iax is udp based, port 4569 */ (packet->udp->source == htons(4569) || packet->udp->dest == htons(4569)) /* check for iax new packet */ && packet->payload_packet_len >= 12 /* check for dst call id == 0, do not check for highest bit (packet retransmission) */ // && (ntohs(get_u_int16_t(packet->payload, 2)) & 0x7FFF) == 0 /* check full IAX packet */ && (packet->payload[0] & 0x80) != 0 /* outbound seq == 0 */ && packet->payload[8] == 0 /* inbound seq == 0 || 1 */ && (packet->payload[9] == 0 || packet->payload[9] == 0x01) /* */ && packet->payload[10] == 0x06 /* IAX type: 0-15 */ && packet->payload[11] <= 15) { if (packet->payload_packet_len == 12) { NDPI_LOG(NDPI_PROTOCOL_IAX, ndpi_struct, NDPI_LOG_DEBUG, "found IAX.\n"); ndpi_int_iax_add_connection(ndpi_struct, flow); return; } packet_len = 12; for (i = 0; i < NDPI_IAX_MAX_INFORMATION_ELEMENTS; i++) { packet_len = packet_len + 2 + packet->payload[packet_len + 1]; if (packet_len == packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_IAX, ndpi_struct, NDPI_LOG_DEBUG, "found IAX.\n"); ndpi_int_iax_add_connection(ndpi_struct, flow); return; } if (packet_len > packet->payload_packet_len) { break; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IAX); } void ndpi_search_iax(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_flow_struct *flow=ndpi_struct->flow; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if(packet->udp && (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN)) ndpi_search_setup_iax(ndpi_struct, flow); } void init_iax_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("IAX", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IAX, ndpi_search_iax, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/icecast.c000066400000000000000000000073061321103654100173110ustar00rootroot00000000000000/* * icecast.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_ICECAST static void ndpi_int_icecast_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ICECAST, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_icecast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int8_t i; NDPI_LOG(NDPI_PROTOCOL_ICECAST, ndpi_struct, NDPI_LOG_DEBUG, "search icecast.\n"); if ((packet->payload_packet_len < 500 && packet->payload_packet_len >= 7 && memcmp(packet->payload, "SOURCE ", 7) == 0) || flow->l4.tcp.icecast_stage) { ndpi_parse_packet_line_info_any(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_ICECAST, ndpi_struct, NDPI_LOG_DEBUG, "Icecast lines=%d\n", packet->parsed_lines); for (i = 0; i < packet->parsed_lines; i++) { if (packet->line[i].ptr != NULL && packet->line[i].len > 4 && memcmp(packet->line[i].ptr, "ice-", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_ICECAST, ndpi_struct, NDPI_LOG_DEBUG, "Icecast detected.\n"); ndpi_int_icecast_add_connection(ndpi_struct, flow); return; } } if (packet->parsed_lines < 1 && !flow->l4.tcp.icecast_stage) { flow->l4.tcp.icecast_stage = 1; return; } } #ifdef NDPI_PROTOCOL_HTTP if (NDPI_FLOW_PROTOCOL_EXCLUDED(ndpi_struct, flow, NDPI_PROTOCOL_HTTP)) { goto icecast_exclude; } #endif if (packet->packet_direction == flow->setup_packet_direction && flow->packet_counter < 10) { return; } if (packet->packet_direction != flow->setup_packet_direction) { /* server answer, now test Server for Icecast */ ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->server_line.ptr != NULL && packet->server_line.len > NDPI_STATICSTRING_LEN("Icecast") && memcmp(packet->server_line.ptr, "Icecast", NDPI_STATICSTRING_LEN("Icecast")) == 0) { NDPI_LOG(NDPI_PROTOCOL_ICECAST, ndpi_struct, NDPI_LOG_DEBUG, "Icecast detected.\n"); /* TODO maybe store the previous protocol type as subtype? * e.g. ogg or mpeg */ ndpi_int_icecast_add_connection(ndpi_struct, flow); return; } } icecast_exclude: NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_ICECAST); NDPI_LOG(NDPI_PROTOCOL_ICECAST, ndpi_struct, NDPI_LOG_DEBUG, "Icecast excluded.\n"); } void init_icecast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("IceCast", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_ICECAST, ndpi_search_icecast_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ipp.c000066400000000000000000000107111321103654100164600ustar00rootroot00000000000000/* * ipp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_IPP static void ndpi_int_ipp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IPP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_ipp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int8_t i; NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "search ipp\n"); if (packet->payload_packet_len > 20) { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "searching for a payload with a pattern like 'number(1to8)blanknumber(1to3)ipp://.\n"); /* this pattern means that there is a printer saying that his state is idle, * means that he is not printing anything at the moment */ i = 0; if (packet->payload[i] < '0' || packet->payload[i] > '9') { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "payload does not begin with a number.\n"); goto search_for_next_pattern; } for (;;) { i++; if (!((packet->payload[i] >= '0' && packet->payload[i] <= '9') || (packet->payload[i] >= 'a' && packet->payload[i] <= 'f') || (packet->payload[i] >= 'A' && packet->payload[i] <= 'F')) || i > 8) { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "read symbols while the symbol is a number.\n"); break; } } if (packet->payload[i++] != ' ') { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "there is no blank following the number.\n"); goto search_for_next_pattern; } if (packet->payload[i] < '0' || packet->payload[i] > '9') { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "no number following the blank.\n"); goto search_for_next_pattern; } for (;;) { i++; if (packet->payload[i] < '0' || packet->payload[i] > '9' || i > 12) { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "read symbols while the symbol is a number.\n"); break; } } if (memcmp(&packet->payload[i], " ipp://", 7) != 0) { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "the string ' ipp://' does not follow.\n"); goto search_for_next_pattern; } NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "found ipp\n"); ndpi_int_ipp_add_connection(ndpi_struct, flow); return; } search_for_next_pattern: if (packet->payload_packet_len > 3 && memcmp(packet->payload, "POST", 4) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->content_line.ptr != NULL && packet->content_line.len > 14 && memcmp(packet->content_line.ptr, "application/ipp", 15) == 0) { NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "found ipp via POST ... application/ipp.\n"); ndpi_int_ipp_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_IPP, ndpi_struct, NDPI_LOG_DEBUG, "no ipp detected.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IPP); } void init_ipp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("IPP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IPP, ndpi_search_ipp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/irc.c000066400000000000000000000775731321103654100164700ustar00rootroot00000000000000/* * irc.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_IRC #define NDPI_IRC_FIND_LESS(time_err,less) {int t1 = 0; \ u_int32_t timestamp = time_err[0]; \ for(t1=0;t1 < NDPI_PROTOCOL_IRC_MAXPORT;t1++) { \ if(timestamp > time_err[t1]) { \ timestamp = time_err[t1]; \ less = t1;}}} static void ndpi_int_irc_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_IRC, NDPI_PROTOCOL_UNKNOWN); } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_is_duplicate(struct ndpi_id_struct *id_t, u_int16_t port) { int index = 0; while (index < id_t->irc_number_of_port) { if (port == id_t->irc_port[index]) return 1; index++; } return 0; } static u_int8_t ndpi_check_for_NOTICE_or_PRIVMSG(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // u_int16_t i; u_int8_t number_of_lines_to_be_searched_for = 0; for (i = 0; i < packet->payload_packet_len - 7; i++) { if (packet->payload[i] == 'N' || packet->payload[i] == 'P') { if (memcmp(&packet->payload[i + 1], "OTICE ", 6) == 0 || memcmp(&packet->payload[i + 1], "RIVMSG ", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found NOTICE or PRIVMSG\n"); return 1; } } if (packet->payload[i] == 0x0a) { number_of_lines_to_be_searched_for++; if (number_of_lines_to_be_searched_for == 2) { return 0; } } } return 0; } static u_int8_t ndpi_check_for_Nickname(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t i, packetl = packet->payload_packet_len; if (packetl < 4) { return 0; } for (i = 0; i < (packetl - 4); i++) { if (packet->payload[i] == 'N' || packet->payload[i] == 'n') { if ((((packetl - (i + 1)) >= 4) && memcmp(&packet->payload[i + 1], "ick=", 4) == 0) || (((packetl - (i + 1)) >= 8) && (memcmp(&packet->payload[i + 1], "ickname=", 8) == 0)) || (((packetl - (i + 1)) >= 8) && (memcmp(&packet->payload[i + 1], "ickName=", 8) == 0))) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found HTTP IRC Nickname pattern\n"); return 1; } } } return 0; } static u_int8_t ndpi_check_for_cmd(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t i; if (packet->payload_packet_len < 4) { return 0; } for (i = 0; i < packet->payload_packet_len - 4; i++) { if (packet->payload[i] == 'c') { if (memcmp(&packet->payload[i + 1], "md=", 3) == 0) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found HTTP IRC cmd pattern \n"); return 1; } } } return 0; } static u_int8_t ndpi_check_for_IRC_traces(const u_int8_t * ptr, u_int16_t len) { u_int16_t i; if (len < 4) { return 0; } for (i = 0; i < len - 4; i++) { if (ptr[i] == 'i') { if (memcmp(&ptr[i + 1], "rc.", 3) == 0) { return 1; } } } return 0; } u_int8_t ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "called ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast\n"); /* case 1: len 1460, len 1460, len 1176 several times in one direction, than len = 4, 4096, 8192 in the other direction */ if (packet->payload_packet_len == 1460 && ((flow->l4.tcp.irc_stage2 == 0 && flow->l4.tcp.irc_direction == 0) || (flow->l4.tcp.irc_stage2 == 3 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction))) { flow->l4.tcp.irc_stage2 = 1; flow->l4.tcp.irc_direction = 1 + packet->packet_direction; return 1; } if (packet->payload_packet_len == 1460 && flow->l4.tcp.irc_stage2 == 1 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction) { flow->l4.tcp.irc_stage2 = 2; return 1; } if (packet->payload_packet_len == 1176 && flow->l4.tcp.irc_stage2 == 2 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction) { flow->l4.tcp.irc_stage2 = 3; flow->l4.tcp.irc_0x1000_full = 1; return 1; } if (packet->payload_packet_len == 4 && (flow->l4.tcp.irc_stage2 == 3 || flow->l4.tcp.irc_0x1000_full == 1) && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 0x1000 || ntohs(get_u_int16_t(packet->payload, 2)) == 0x2000)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1460,1460,1176,<-4096||8192"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } /* case 2: len 1448, len 1448, len 1200 several times in one direction, than len = 4, 4096, 8192 in the other direction */ if (packet->payload_packet_len == 1448 && ((flow->l4.tcp.irc_stage2 == 0 && flow->l4.tcp.irc_direction == 0) || (flow->l4.tcp.irc_stage2 == 6 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction))) { flow->l4.tcp.irc_stage2 = 4; flow->l4.tcp.irc_direction = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "len = 1448 first\n"); return 1; } if (packet->payload_packet_len == 1448 && flow->l4.tcp.irc_stage2 == 4 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction) { flow->l4.tcp.irc_stage2 = 5; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "len = 1448 second \n"); return 1; } if (packet->payload_packet_len == 1200 && flow->l4.tcp.irc_stage2 == 5 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction) { flow->l4.tcp.irc_stage2 = 6; flow->l4.tcp.irc_0x1000_full = 1; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "len = 1200 \n"); return 1; } if (packet->payload_packet_len == 4 && (flow->l4.tcp.irc_stage2 == 6 || flow->l4.tcp.irc_0x1000_full == 1) && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 0x1000 || ntohs(get_u_int16_t(packet->payload, 2)) == 0x2000)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1448,1448,1200,<-4096||8192"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } /* case 3: several packets with len 1380, 1200, 1024, 1448, 1248, * than one packet in the other direction with the len or two times the len. */ if (packet->payload_packet_len == 1380 && ((flow->l4.tcp.irc_stage2 == 0 && flow->l4.tcp.irc_direction == 0) || (flow->l4.tcp.irc_stage2 == 7 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction))) { flow->l4.tcp.irc_stage2 = 7; flow->l4.tcp.irc_direction = 1 + packet->packet_direction; return 1; } if (packet->payload_packet_len == 4 && flow->l4.tcp.irc_stage2 == 7 && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1380 || ntohs(get_u_int16_t(packet->payload, 2)) == 2760)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1380,<-1380||2760"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } if (packet->payload_packet_len == 1200 && ((flow->l4.tcp.irc_stage2 == 0 && flow->l4.tcp.irc_direction == 0) || (flow->l4.tcp.irc_stage2 == 8 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction))) { flow->l4.tcp.irc_stage2 = 8; flow->l4.tcp.irc_direction = 1 + packet->packet_direction; return 1; } if (packet->payload_packet_len == 4 && flow->l4.tcp.irc_stage2 == 8 && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1200 || ntohs(get_u_int16_t(packet->payload, 2)) == 2400)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1200,<-1200||2400"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } if (packet->payload_packet_len == 1024 && ((flow->l4.tcp.irc_stage2 == 0 && flow->l4.tcp.irc_direction == 0) || (flow->l4.tcp.irc_stage2 == 9 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction))) { flow->l4.tcp.irc_stage2 = 9; flow->l4.tcp.irc_direction = 1 + packet->packet_direction; return 1; } if (packet->payload_packet_len == 4 && (flow->l4.tcp.irc_stage2 == 9 || flow->l4.tcp.irc_stage2 == 15) && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1024 || ntohs(get_u_int16_t(packet->payload, 2)) == 2048)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1024,<-1024||2048"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } if (packet->payload_packet_len == 1248 && ((flow->l4.tcp.irc_stage2 == 0 && flow->l4.tcp.irc_direction == 0) || (flow->l4.tcp.irc_stage2 == 10 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction))) { flow->l4.tcp.irc_stage2 = 10; flow->l4.tcp.irc_direction = 1 + packet->packet_direction; return 1; } if (packet->payload_packet_len == 4 && flow->l4.tcp.irc_stage2 == 10 && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1248 || ntohs(get_u_int16_t(packet->payload, 2)) == 2496)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1248,<-1248||2496"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } if (packet->payload_packet_len == 1448 && (flow->l4.tcp.irc_stage2 == 5 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 11; return 1; } if (packet->payload_packet_len == 4 && (flow->l4.tcp.irc_stage2 == 4 || flow->l4.tcp.irc_stage2 == 5 || flow->l4.tcp.irc_stage2 == 11 || flow->l4.tcp.irc_stage2 == 13) && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && (ntohs(get_u_int16_t(packet->payload, 2)) == 1448 || ntohs(get_u_int16_t(packet->payload, 2)) == 2896)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1448,<-1448||2896"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } /* case 4 : five packets with len = 1448, one with len 952, than one packet from other direction len = 8192 */ if (packet->payload_packet_len == 1448 && (flow->l4.tcp.irc_stage2 == 11 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 12; return 1; } if (packet->payload_packet_len == 1448 && (flow->l4.tcp.irc_stage2 == 12 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 13; return 1; } if (packet->payload_packet_len == 952 && (flow->l4.tcp.irc_stage2 == 13 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 14; return 1; } if (packet->payload_packet_len == 4 && flow->l4.tcp.irc_stage2 == 14 && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && ntohs(get_u_int16_t(packet->payload, 2)) == 8192) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1448,1448,1448,1448,1448,952,<-8192"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } /* case 5: len 1024, len 1448, len 1448, len 1200, len 1448, len 600 */ if (packet->payload_packet_len == 1448 && (flow->l4.tcp.irc_stage2 == 9 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 15; return 1; } if (packet->payload_packet_len == 1448 && (flow->l4.tcp.irc_stage2 == 15 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 16; return 1; } if (packet->payload_packet_len == 1200 && (flow->l4.tcp.irc_stage2 == 16 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 17; return 1; } if (packet->payload_packet_len == 1448 && (flow->l4.tcp.irc_stage2 == 17 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 18; return 1; } if (packet->payload_packet_len == 600 && (flow->l4.tcp.irc_stage2 == 18 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 19; return 1; } if (packet->payload_packet_len == 4 && flow->l4.tcp.irc_stage2 == 19 && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && ntohs(get_u_int16_t(packet->payload, 2)) == 7168) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1024,1448,1448,1200,1448,600,<-7168"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } /* -> 1024, 1380, -> 2404 */ if (packet->payload_packet_len == 1380 && (flow->l4.tcp.irc_stage2 == 9 && flow->l4.tcp.irc_direction == 1 + packet->packet_direction)) { flow->l4.tcp.irc_stage2 = 20; return 1; } if (packet->payload_packet_len == 4 && flow->l4.tcp.irc_stage2 == 20 && flow->l4.tcp.irc_direction == 2 - packet->packet_direction && ntohs(get_u_int16_t(packet->payload, 2)) == 2404) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected: ->1024,1380 <-2404"); ndpi_int_irc_add_connection(ndpi_struct, flow); return 1; } return 0; } void ndpi_search_irc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; int less; u_int16_t c = 0; u_int16_t c1 = 0; u_int16_t port = 0; u_int16_t sport = 0; u_int16_t dport = 0; u_int16_t counter = 0; u_int16_t i = 0; u_int16_t j = 0; u_int16_t k = 0; u_int16_t h; u_int16_t http_content_ptr_len = 0; u_int8_t space = 0; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "irc : search irc\n"); if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter > 70) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "exclude irc, packet_counter > 70\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IRC); return; } if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter > 30 && flow->l4.tcp.irc_stage2 == 0) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "packet_counter > 30, exclude irc.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_IRC); return; } if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_IRC) { if (src != NULL && ((u_int32_t) (packet->tick_timestamp - src->irc_ts) < ndpi_struct->irc_timeout)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "irc : save src connection packet detected\n"); src->irc_ts = packet->tick_timestamp; } else if (dst != NULL && ((u_int32_t) (packet->tick_timestamp - dst->irc_ts) < ndpi_struct->irc_timeout)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "irc : save dst connection packet detected\n"); dst->irc_ts = packet->tick_timestamp; } } if (((dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_IRC) && ((u_int32_t) (packet->tick_timestamp - dst->irc_ts)) < ndpi_struct->irc_timeout)) || (src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK (src->detected_protocol_bitmask, NDPI_PROTOCOL_IRC) && ((u_int32_t) (packet->tick_timestamp - src->irc_ts)) < ndpi_struct->irc_timeout)) { if (packet->tcp != NULL) { sport = packet->tcp->source; dport = packet->tcp->dest; } if (dst != NULL) { for (counter = 0; counter < dst->irc_number_of_port; counter++) { if (dst->irc_port[counter] == sport || dst->irc_port[counter] == dport) { dst->last_time_port_used[counter] = packet->tick_timestamp; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "dest port matched with the DCC port and the flow is marked as IRC"); ndpi_int_irc_add_connection(ndpi_struct, flow); return; } } } if (src != NULL) { for (counter = 0; counter < src->irc_number_of_port; counter++) { if (src->irc_port[counter] == sport || src->irc_port[counter] == dport) { src->last_time_port_used[counter] = packet->tick_timestamp; ndpi_int_irc_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "Source port matched with the DCC port and the flow is marked as IRC"); return; } } } } if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter == 2 && (packet->payload_packet_len > 400 && packet->payload_packet_len < 1381)) { for (c1 = 50; c1 < packet->payload_packet_len - 23; c1++) { if (packet->payload[c1] == 'i' || packet->payload[c1] == 'd') { if ((memcmp(&packet->payload[c1], "irc.hackthissite.org0", 21) == 0) || (memcmp(&packet->payload[c1], "irc.gamepad.ca1", 15) == 0) || (memcmp(&packet->payload[c1], "dungeon.axenet.org0", 19) == 0) || (memcmp(&packet->payload[c1], "dazed.nuggethaus.net", 20) == 0) || (memcmp(&packet->payload[c1], "irc.indymedia.org", 17) == 0) || (memcmp(&packet->payload[c1], "irc.cccp-project.net", 20) == 0) || (memcmp(&packet->payload[c1], "dirc.followell.net0", 19) == 0) || (memcmp(&packet->payload[c1], "irc.discostars.de1", 18) == 0) || (memcmp(&packet->payload[c1], "irc.rizon.net", 13) == 0)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC SSL detected with :- irc.hackthissite.org0 | irc.gamepad.ca1 | dungeon.axenet.org0 " "| dazed.nuggethaus.net | irc.indymedia.org | irc.discostars.de1 "); ndpi_int_irc_add_connection(ndpi_struct, flow); break; } } } } if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && ndpi_search_irc_ssl_detect_ninety_percent_but_very_fast(ndpi_struct, flow) != 0) { return; } if (flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC && flow->packet_counter < 20 && packet->payload_packet_len >= 8) { if (get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x0a || (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0a00)) { if (memcmp(packet->payload, ":", 1) == 0) { if (packet->payload[packet->payload_packet_len - 2] != 0x0d && packet->payload[packet->payload_packet_len - 1] == 0x0a) { ndpi_parse_packet_line_info_any(ndpi_struct, flow); } else if (packet->payload[packet->payload_packet_len - 2] == 0x0d) { ndpi_parse_packet_line_info(ndpi_struct, flow); } else { flow->l4.tcp.irc_3a_counter++; } for (i = 0; i < packet->parsed_lines; i++) { if (packet->line[i].ptr[0] == ':') { flow->l4.tcp.irc_3a_counter++; if (flow->l4.tcp.irc_3a_counter == 7) { /* ':' == 0x3a */ NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "0x3a. seven times. found irc."); ndpi_int_irc_add_connection(ndpi_struct, flow); goto detected_irc; } } } if (flow->l4.tcp.irc_3a_counter == 7) { /* ':' == 0x3a */ NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "0x3a. seven times. found irc."); ndpi_int_irc_add_connection(ndpi_struct, flow); goto detected_irc; } } if ((memcmp(packet->payload, "USER ", 5) == 0) || (memcmp(packet->payload, "NICK ", 5) == 0) || (memcmp(packet->payload, "PASS ", 5) == 0) || (memcmp(packet->payload, ":", 1) == 0 && ndpi_check_for_NOTICE_or_PRIVMSG(ndpi_struct, flow) != 0) || (memcmp(packet->payload, "PONG ", 5) == 0) || (memcmp(packet->payload, "PING ", 5) == 0) || (memcmp(packet->payload, "JOIN ", 5) == 0) || (memcmp(packet->payload, "NOTICE ", 7) == 0) || (memcmp(packet->payload, "PRIVMSG ", 8) == 0) || (memcmp(packet->payload, "VERSION ", 8) == 0)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "USER, NICK, PASS, NOTICE, PRIVMSG one time"); if (flow->l4.tcp.irc_stage == 2) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "found irc"); ndpi_int_irc_add_connection(ndpi_struct, flow); flow->l4.tcp.irc_stage = 3; } if (flow->l4.tcp.irc_stage == 1) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "second time, stage=2"); flow->l4.tcp.irc_stage = 2; } if (flow->l4.tcp.irc_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "first time, stage=1"); flow->l4.tcp.irc_stage = 1; } /* irc packets can have either windows line breaks (0d0a) or unix line breaks (0a) */ if (packet->payload[packet->payload_packet_len - 2] == 0x0d && packet->payload[packet->payload_packet_len - 1] == 0x0a) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->parsed_lines > 1) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "packet contains more than one line"); for (c = 1; c < packet->parsed_lines; c++) { if (packet->line[c].len > 4 && (memcmp(packet->line[c].ptr, "NICK ", 5) == 0 || memcmp(packet->line[c].ptr, "USER ", 5) == 0)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "two icq signal words in the same packet"); ndpi_int_irc_add_connection(ndpi_struct, flow); flow->l4.tcp.irc_stage = 3; return; } } } } else if (packet->payload[packet->payload_packet_len - 1] == 0x0a) { ndpi_parse_packet_line_info_any(ndpi_struct, flow); if (packet->parsed_lines > 1) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "packet contains more than one line"); for (c = 1; c < packet->parsed_lines; c++) { if (packet->line[c].len > 4 && (memcmp(packet->line[c].ptr, "NICK ", 5) == 0 || memcmp(packet->line[c].ptr, "USER ", 5) == 0)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "two icq signal words in the same packet"); ndpi_int_irc_add_connection(ndpi_struct, flow); flow->l4.tcp.irc_stage = 3; return; } } } } } } } /** * Trying to primarily detect the HTTP Web based IRC chat patterns based on the HTTP headers * during the User login time.When the HTTP data gets posted using the POST method ,patterns * will be searched in the HTTP content. */ if ((flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC) && (flow->l4.tcp.irc_stage == 0) && (packet->payload_packet_len > 5)) { //HTTP POST Method being employed if (memcmp(packet->payload, "POST ", 5) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->parsed_lines) { u_int16_t http_header_len = (u_int16_t)((packet->line[packet->parsed_lines - 1].ptr - packet->payload) + 2); if (packet->payload_packet_len > http_header_len) { http_content_ptr_len = packet->payload_packet_len - http_header_len; } if ((ndpi_check_for_IRC_traces(packet->line[0].ptr, packet->line[0].len)) || ((packet->http_url_name.ptr) && (ndpi_check_for_IRC_traces(packet->http_url_name.ptr, packet->http_url_name.len))) || ((packet->referer_line.ptr) && (ndpi_check_for_IRC_traces(packet->referer_line.ptr, packet->referer_line.len)))) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC detected from the Http URL/ Referer header "); flow->l4.tcp.irc_stage = 1; // HTTP POST Request body is not in the same packet. if (!http_content_ptr_len) { return; } } } } } if ((flow->detected_protocol_stack[0] != NDPI_PROTOCOL_IRC) && (flow->l4.tcp.irc_stage == 1)) { if ((((packet->payload_packet_len - http_content_ptr_len) > 10) && (memcmp(packet->payload + http_content_ptr_len, "interface=", 10) == 0) && (ndpi_check_for_Nickname(ndpi_struct, flow) != 0)) || (((packet->payload_packet_len - http_content_ptr_len) > 5) && (memcmp(packet->payload + http_content_ptr_len, "item=", 5) == 0) && (ndpi_check_for_cmd(ndpi_struct, flow) != 0))) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "IRC Nickname, cmd, one time"); ndpi_int_irc_add_connection(ndpi_struct, flow); return; } } detected_irc: NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "detected_irc:"); if (flow->detected_protocol_stack[0] == NDPI_PROTOCOL_IRC) { /* maybe this can be deleted at the end */ if (packet->payload[packet->payload_packet_len - 2] != 0x0d && packet->payload[packet->payload_packet_len - 1] == 0x0a) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "ndpi_parse_packet_line_info_any(ndpi_struct, flow);"); ndpi_parse_packet_line_info_any(ndpi_struct, flow); } else if (packet->payload[packet->payload_packet_len - 2] == 0x0d) { ndpi_parse_packet_line_info(ndpi_struct, flow); } else { return; } for (i = 0; i < packet->parsed_lines; i++) { if (packet->line[i].len > 6 && memcmp(packet->line[i].ptr, "NOTICE ", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "NOTICE"); for (j = 7; j < packet->line[i].len - 8; j++) { if (packet->line[i].ptr[j] == ':') { if (memcmp(&packet->line[i].ptr[j + 1], "DCC SEND ", 9) == 0 || memcmp(&packet->line[i].ptr[j + 1], "DCC CHAT ", 9) == 0) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "found NOTICE and DCC CHAT or DCC SEND."); } } } } if (packet->payload_packet_len > 0 && packet->payload[0] == 0x3a /* 0x3a = ':' */ ) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "3a"); for (j = 1; j < packet->line[i].len - 9; j++) { if (packet->line[i].ptr[j] == ' ') { j++; if (packet->line[i].ptr[j] == 'P') { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "P"); j++; if (memcmp(&packet->line[i].ptr[j], "RIVMSG ", 7) == 0) NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "RIVMSG"); h = j + 7; goto read_privmsg; } } } } if (packet->line[i].len > 7 && (memcmp(packet->line[i].ptr, "PRIVMSG ", 8) == 0)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "PRIVMSG "); h = 7; read_privmsg: for (j = h; j < packet->line[i].len - 9; j++) { if (packet->line[i].ptr[j] == ':') { if (memcmp(&packet->line[i].ptr[j + 1], "xdcc ", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "xdcc should match."); } j += 2; if (memcmp(&packet->line[i].ptr[j], "DCC ", 4) == 0) { j += 4; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "found DCC."); if (memcmp(&packet->line[i].ptr[j], "SEND ", 5) == 0 || (memcmp(&packet->line[i].ptr[j], "CHAT", 4) == 0) || (memcmp(&packet->line[i].ptr[j], "chat", 4) == 0) || (memcmp(&packet->line[i].ptr[j], "sslchat", 7) == 0) || (memcmp(&packet->line[i].ptr[j], "TSEND", 5) == 0)) { NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "found CHAT,chat,sslchat,TSEND."); j += 4; while (packet->line[i].len > j && ((packet->line[i].ptr[j] >= 'a' && packet->line[i].ptr[j] <= 'z') || (packet->line[i].ptr[j] >= 'A' && packet->line[i].ptr[j] <= 'Z') || (packet->line[i].ptr[j] >= '0' && packet->line[i].ptr[j] <= '9') || (packet->line[i].ptr[j] >= ' ') || (packet->line[i].ptr[j] >= '.') || (packet->line[i].ptr[j] >= '-'))) { if (packet->line[i].ptr[j] == ' ') { space++; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "space %u.", space); } if (space == 3) { j++; NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "read port."); if (src != NULL) { k = j; port = ntohs_ndpi_bytestream_to_number (&packet->line[i].ptr[j], packet->payload_packet_len - j, &j); NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "port %u.", port); j = k; // hier jetzt überlegen, wie die ports abgespeichert werden sollen if (src->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT) NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "src->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT."); if (src->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT && port != 0) { if (!ndpi_is_duplicate(src, port)) { src->irc_port[src->irc_number_of_port] = port; src->irc_number_of_port++; NDPI_LOG (NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found port=%d", ntohs(get_u_int16_t(src->irc_port, 0))); NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "jjeeeeeeeeeeeeeeeeeeeeeeeee"); } src->irc_ts = packet->tick_timestamp; } else if (port != 0 && src->irc_number_of_port == NDPI_PROTOCOL_IRC_MAXPORT) { if (!ndpi_is_duplicate(src, port)) { less = 0; NDPI_IRC_FIND_LESS(src->last_time_port_used, less); src->irc_port[less] = port; NDPI_LOG (NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found port=%d", ntohs(get_u_int16_t(src->irc_port, 0))); } src->irc_ts = packet->tick_timestamp; } if (dst == NULL) { break; } } if (dst != NULL) { port = ntohs_ndpi_bytestream_to_number (&packet->line[i].ptr[j], packet->payload_packet_len - j, &j); NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_TRACE, "port %u.", port); // hier das gleiche wie oben. /* hier werden NDPI_PROTOCOL_IRC_MAXPORT ports pro irc flows mitgespeichert. könnte man denn nicht ein- * fach an die dst oder src einen flag setzten, dass dieser port für eine bestimmte * zeit ein irc-port bleibt? */ if (dst->irc_number_of_port < NDPI_PROTOCOL_IRC_MAXPORT && port != 0) { if (!ndpi_is_duplicate(dst, port)) { dst->irc_port[dst->irc_number_of_port] = port; dst->irc_number_of_port++; NDPI_LOG (NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found port=%d", ntohs(get_u_int16_t(dst->irc_port, 0))); NDPI_LOG(NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "juuuuuuuuuuuuuuuu"); } dst->irc_ts = packet->tick_timestamp; } else if (port != 0 && dst->irc_number_of_port == NDPI_PROTOCOL_IRC_MAXPORT) { if (!ndpi_is_duplicate(dst, port)) { less = 0; NDPI_IRC_FIND_LESS(dst->last_time_port_used, less); dst->irc_port[less] = port; NDPI_LOG (NDPI_PROTOCOL_IRC, ndpi_struct, NDPI_LOG_DEBUG, "found port=%d", ntohs(get_u_int16_t(dst->irc_port, 0))); } dst->irc_ts = packet->tick_timestamp; } break; } } j++; } } } } } } } } } void init_irc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("IRC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IRC, ndpi_search_irc_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/jabber.c000066400000000000000000000301721321103654100171200ustar00rootroot00000000000000/* * jabber.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_UNENCRYPTED_JABBER struct jabber_string { char *string; u_int ndpi_protocol; }; static struct jabber_string jabber_strings[] = { #ifdef NDPI_PROTOCOL_TRUPHONE { "='im.truphone.com'", NDPI_PROTOCOL_TRUPHONE }, { "=\"im.truphone.com\"", NDPI_PROTOCOL_TRUPHONE }, #endif { NULL, 0 } }; static void ndpi_int_jabber_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int32_t protocol) { ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_UNKNOWN); } static void check_content_type_and_change_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int16_t x) { struct ndpi_packet_struct *packet = &flow->packet; int i, left = packet->payload_packet_len-x; if(left <= 0) return; for(i=0; jabber_strings[i].string != NULL; i++) { if(ndpi_strnstr((const char*)&packet->payload[x], jabber_strings[i].string, left) != NULL) { ndpi_int_jabber_add_connection(ndpi_struct, flow, jabber_strings[i].ndpi_protocol); return; } } } void ndpi_search_jabber_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; u_int16_t x; NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_TRACE, "JABBER detection....\n"); /* search for jabber file transfer */ /* this part is working asymmetrically */ if (packet->tcp != NULL && packet->tcp->syn != 0 && packet->payload_packet_len == 0) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "check jabber syn\n"); if (src != NULL && src->jabber_file_transfer_port[0] != 0) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "src jabber ft port set, ports are: %u, %u\n", ntohs(src->jabber_file_transfer_port[0]), ntohs(src->jabber_file_transfer_port[1])); if (((u_int32_t) (packet->tick_timestamp - src->jabber_stun_or_ft_ts)) >= ndpi_struct->jabber_file_transfer_timeout) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "JABBER src stun timeout %u %u\n", src->jabber_stun_or_ft_ts, packet->tick_timestamp); src->jabber_file_transfer_port[0] = 0; src->jabber_file_transfer_port[1] = 0; } else if (src->jabber_file_transfer_port[0] == packet->tcp->dest || src->jabber_file_transfer_port[0] == packet->tcp->source || src->jabber_file_transfer_port[1] == packet->tcp->dest || src->jabber_file_transfer_port[1] == packet->tcp->source) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "found jabber file transfer.\n"); ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_UNENCRYPTED_JABBER); } } if (dst != NULL && dst->jabber_file_transfer_port[0] != 0) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "dst jabber ft port set, ports are: %u, %u\n", ntohs(dst->jabber_file_transfer_port[0]), ntohs(dst->jabber_file_transfer_port[1])); if (((u_int32_t) (packet->tick_timestamp - dst->jabber_stun_or_ft_ts)) >= ndpi_struct->jabber_file_transfer_timeout) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "JABBER dst stun timeout %u %u\n", dst->jabber_stun_or_ft_ts, packet->tick_timestamp); dst->jabber_file_transfer_port[0] = 0; dst->jabber_file_transfer_port[1] = 0; } else if (dst->jabber_file_transfer_port[0] == packet->tcp->dest || dst->jabber_file_transfer_port[0] == packet->tcp->source || dst->jabber_file_transfer_port[1] == packet->tcp->dest || dst->jabber_file_transfer_port[1] == packet->tcp->source) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "found jabber file transfer.\n"); ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_UNENCRYPTED_JABBER); } } return; } if (packet->tcp != 0 && packet->payload_packet_len == 0) { return; } /* this part parses a packet and searches for port=. it works asymmetrically. */ if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNENCRYPTED_JABBER) { u_int16_t lastlen; u_int16_t j_port = 0; /* check for google jabber voip connections ... */ /* need big packet */ if (packet->payload_packet_len < 100) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "packet too small, return.\n"); return; } /* need message to or type for file-transfer */ if (memcmp(packet->payload, "payload, "payload_packet_len - 11; for (x = 10; x < lastlen; x++) { if (packet->payload[x] == 'p') { if (memcmp(&packet->payload[x], "port=", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "port=\n"); if (src != NULL) { src->jabber_stun_or_ft_ts = packet->tick_timestamp; } if (dst != NULL) { dst->jabber_stun_or_ft_ts = packet->tick_timestamp; } x += 6; j_port = ntohs_ndpi_bytestream_to_number(&packet->payload[x], packet->payload_packet_len, &x); NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "JABBER port : %u\n", ntohs(j_port)); if (src != NULL) { if (src->jabber_file_transfer_port[0] == 0 || src->jabber_file_transfer_port[0] == j_port) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "src->jabber_file_transfer_port[0] = j_port = %u;\n", ntohs(j_port)); src->jabber_file_transfer_port[0] = j_port; } else { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "src->jabber_file_transfer_port[1] = j_port = %u;\n", ntohs(j_port)); src->jabber_file_transfer_port[1] = j_port; } } if (dst != NULL) { if (dst->jabber_file_transfer_port[0] == 0 || dst->jabber_file_transfer_port[0] == j_port) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "dst->jabber_file_transfer_port[0] = j_port = %u;\n", ntohs(j_port)); dst->jabber_file_transfer_port[0] = j_port; } else { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "dst->jabber_file_transfer_port[1] = j_port = %u;\n", ntohs(j_port)); dst->jabber_file_transfer_port[1] = j_port; } } } } } } else if (memcmp(packet->payload, "payload, "payload, "payload_packet_len - 21; for (x = 8; x < lastlen; x++) { /* invalid character */ if (packet->payload[x] < 32 || packet->payload[x] > 127) { return; } if (packet->payload[x] == '@') { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "JABBER @\n"); break; } } if (x >= lastlen) { return; } lastlen = packet->payload_packet_len - 10; for (; x < lastlen; x++) { if (packet->payload[x] == 'p') { if (memcmp(&packet->payload[x], "port=", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "port=\n"); if (src != NULL) { src->jabber_stun_or_ft_ts = packet->tick_timestamp; } if (dst != NULL) { dst->jabber_stun_or_ft_ts = packet->tick_timestamp; } x += 6; j_port = ntohs_ndpi_bytestream_to_number(&packet->payload[x], packet->payload_packet_len, &x); NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "JABBER port : %u\n", ntohs(j_port)); if (src != NULL && src->jabber_voice_stun_used_ports < JABBER_MAX_STUN_PORTS - 1) { if (packet->payload[5] == 'o') { src->jabber_voice_stun_port[src->jabber_voice_stun_used_ports++] = j_port; } else { if (src->jabber_file_transfer_port[0] == 0 || src->jabber_file_transfer_port[0] == j_port) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "src->jabber_file_transfer_port[0] = j_port = %u;\n", ntohs(j_port)); src->jabber_file_transfer_port[0] = j_port; } else { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "src->jabber_file_transfer_port[1] = j_port = %u;\n", ntohs(j_port)); src->jabber_file_transfer_port[1] = j_port; } } } if (dst != NULL && dst->jabber_voice_stun_used_ports < JABBER_MAX_STUN_PORTS - 1) { if (packet->payload[5] == 'o') { dst->jabber_voice_stun_port[dst->jabber_voice_stun_used_ports++] = j_port; } else { if (dst->jabber_file_transfer_port[0] == 0 || dst->jabber_file_transfer_port[0] == j_port) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "dst->jabber_file_transfer_port[0] = j_port = %u;\n", ntohs(j_port)); dst->jabber_file_transfer_port[0] = j_port; } else { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "dst->jabber_file_transfer_port[1] = j_port = %u;\n", ntohs(j_port)); dst->jabber_file_transfer_port[1] = j_port; } } } return; } } } } return; } /* search for jabber here */ /* this part is working asymmetrically */ if ((packet->payload_packet_len > 13 && memcmp(packet->payload, "payload_packet_len >= NDPI_STATICSTRING_LEN("payload, "payload_packet_len-13; if(ndpi_strnstr((const char *)&packet->payload[13], "xmlns:stream='http://etherx.jabber.org/streams'", start) || ndpi_strnstr((const char *)&packet->payload[13], "xmlns:stream=\"http://etherx.jabber.org/streams\"", start)) { /* Protocol family */ ndpi_int_jabber_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_UNENCRYPTED_JABBER); /* search for subprotocols */ check_content_type_and_change_protocol(ndpi_struct, flow, 13); return; } } if (flow->packet_counter < 3) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "packet_counter: %u\n", flow->packet_counter); return; } NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_TRACE, "JABBER Excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_UNENCRYPTED_JABBER); #ifdef NDPI_PROTOCOL_TRUPHONE NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TRUPHONE); #endif } void init_jabber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Unencrypted_Jabber", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_search_jabber_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/kakaotalk_voice.c000066400000000000000000000045561321103654100210310ustar00rootroot00000000000000/* * kakaotalk_voice.c * * Copyright (C) 2015 - ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ /* KakaoTalk (call only) http://www.kakao.com/services/talk/voices */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_KAKAOTALK_VOICE void ndpi_search_kakaotalk_voice(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->iph && packet->udp && (packet->payload_packet_len >= 4) ) { if((packet->payload[0] == 0x81) || (packet->payload[1] == 0xC8) || (packet->payload[2] == 0x00) || (packet->payload[3] == 0x0C)) { /* Looks good so far */ /* inetnum: 1.201.0.0 - 1.201.255.255 netname: KINXINC-KR */ if(((ntohl(packet->iph->saddr) & 0xFFFF0000 /* 255.255.0.0 */) == 0x01C90000 /* 1.201.0.0/16 */) || ((ntohl(packet->iph->daddr) & 0xFFFF0000 /* 255.255.0.0 */) == 0x01C90000 /* 1.201.0.0/16 */)) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_KAKAOTALK_VOICE, NDPI_PROTOCOL_UNKNOWN); return; } } } NDPI_LOG(NDPI_PROTOCOL_KAKAOTALK_VOICE, ndpi_struct, NDPI_LOG_DEBUG, "Exclude kakaotalk_voice.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_KAKAOTALK_VOICE); } void init_kakaotalk_voice_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("KakaoTalk_Voice", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_KAKAOTALK_VOICE, ndpi_search_kakaotalk_voice, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/kerberos.c000066400000000000000000000060331321103654100175060ustar00rootroot00000000000000/* * kerberos.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_KERBEROS static void ndpi_int_kerberos_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_KERBEROS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_kerberos(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; /* I have observed 0a,0c,0d,0e at packet->payload[19/21], maybe there are other possibilities */ if (packet->payload_packet_len >= 4 && ntohl(get_u_int32_t(packet->payload, 0)) == packet->payload_packet_len - 4) { if (packet->payload_packet_len > 19 && packet->payload[14] == 0x05 && (packet->payload[19] == 0x0a || packet->payload[19] == 0x0c || packet->payload[19] == 0x0d || packet->payload[19] == 0x0e)) { NDPI_LOG(NDPI_PROTOCOL_KERBEROS, ndpi_struct, NDPI_LOG_DEBUG, "found KERBEROS\n"); ndpi_int_kerberos_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 21 && packet->payload[16] == 0x05 && (packet->payload[21] == 0x0a || packet->payload[21] == 0x0c || packet->payload[21] == 0x0d || packet->payload[21] == 0x0e)) { NDPI_LOG(NDPI_PROTOCOL_KERBEROS, ndpi_struct, NDPI_LOG_DEBUG, "found KERBEROS\n"); ndpi_int_kerberos_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_KERBEROS, ndpi_struct, NDPI_LOG_DEBUG, "no KERBEROS detected.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_KERBEROS); } void init_kerberos_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Kerberos", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_KERBEROS, ndpi_search_kerberos, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/kontiki.c000066400000000000000000000055011321103654100173410ustar00rootroot00000000000000/* * kontiki.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_KONTIKI static void ndpi_int_kontiki_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_KONTIKI, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_kontiki(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len == 4 && (get_u_int32_t(packet->payload, 0) == htonl(0x02010100))) { NDPI_LOG(NDPI_PROTOCOL_KONTIKI, ndpi_struct, NDPI_LOG_DEBUG, "Kontiki UDP detected.\n"); ndpi_int_kontiki_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 0 && packet->payload[0] == 0x02) { if (packet->payload_packet_len == 20 && (get_u_int32_t(packet->payload, 16) == htonl(0x02040100))) { NDPI_LOG(NDPI_PROTOCOL_KONTIKI, ndpi_struct, NDPI_LOG_DEBUG, "Kontiki UDP detected.\n"); ndpi_int_kontiki_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 16 && (get_u_int32_t(packet->payload, 12) == htonl(0x000004e4))) { NDPI_LOG(NDPI_PROTOCOL_KONTIKI, ndpi_struct, NDPI_LOG_DEBUG, "Kontiki UDP detected.\n"); ndpi_int_kontiki_add_connection(ndpi_struct, flow); return; } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_KONTIKI); } void init_kontiki_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Kontiki", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_KONTIKI, ndpi_search_kontiki, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ldap.c000066400000000000000000000075701321103654100166210ustar00rootroot00000000000000/* * ldap.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_LDAP static void ndpi_int_ldap_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_LDAP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_ldap(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; // u_int16_t dport; NDPI_LOG(NDPI_PROTOCOL_LDAP, ndpi_struct, NDPI_LOG_DEBUG, "search ldap\n"); if (packet->payload_packet_len >= 14 && packet->payload[0] == 0x30) { // simple type if (packet->payload[1] == 0x0c && packet->payload_packet_len == 14 && packet->payload[packet->payload_packet_len - 1] == 0x00 && packet->payload[2] == 0x02) { if (packet->payload[3] == 0x01 && (packet->payload[5] == 0x60 || packet->payload[5] == 0x61) && packet->payload[6] == 0x07) { NDPI_LOG(NDPI_PROTOCOL_LDAP, ndpi_struct, NDPI_LOG_DEBUG, "found ldap simple type 1\n"); ndpi_int_ldap_add_connection(ndpi_struct, flow); return; } if (packet->payload[3] == 0x02 && (packet->payload[6] == 0x60 || packet->payload[6] == 0x61) && packet->payload[7] == 0x07) { NDPI_LOG(NDPI_PROTOCOL_LDAP, ndpi_struct, NDPI_LOG_DEBUG, "found ldap simple type 2\n"); ndpi_int_ldap_add_connection(ndpi_struct, flow); return; } } // normal type if (packet->payload[1] == 0x84 && packet->payload_packet_len >= 0x84 && packet->payload[2] == 0x00 && packet->payload[3] == 0x00 && packet->payload[6] == 0x02) { if (packet->payload[7] == 0x01 && (packet->payload[9] == 0x60 || packet->payload[9] == 0x61 || packet->payload[9] == 0x63 || packet->payload[9] == 0x64) && packet->payload[10] == 0x84) { NDPI_LOG(NDPI_PROTOCOL_LDAP, ndpi_struct, NDPI_LOG_DEBUG, "found ldap type 1\n"); ndpi_int_ldap_add_connection(ndpi_struct, flow); return; } if (packet->payload[7] == 0x02 && (packet->payload[10] == 0x60 || packet->payload[10] == 0x61 || packet->payload[10] == 0x63 || packet->payload[10] == 0x64) && packet->payload[11] == 0x84) { NDPI_LOG(NDPI_PROTOCOL_LDAP, ndpi_struct, NDPI_LOG_DEBUG, "found ldap type 2\n"); ndpi_int_ldap_add_connection(ndpi_struct, flow); return; } } } NDPI_LOG(NDPI_PROTOCOL_LDAP, ndpi_struct, NDPI_LOG_DEBUG, "ldap excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_LDAP); } void init_ldap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("LDAP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_LDAP, ndpi_search_ldap, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/lisp.c000066400000000000000000000040121321103654100166340ustar00rootroot00000000000000#include "ndpi_api.h" #ifdef NDPI_PROTOCOL_LISP #define LISP_PORT 4341 #define LISP_PORT1 4342 static void ndpi_int_lisp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t due_to_correlation) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_LISP, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_lisp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { u_int16_t lisp_port = htons(LISP_PORT); u_int16_t lisp_port1 = htons(LISP_PORT1); if(((packet->udp->source == lisp_port) && (packet->udp->dest == lisp_port)) || ((packet->udp->source == lisp_port1) && (packet->udp->dest == lisp_port1)) ) { NDPI_LOG(NDPI_PROTOCOL_LISP, ndpi_struct, NDPI_LOG_DEBUG, "Found lisp.\n"); ndpi_int_lisp_add_connection(ndpi_struct, flow, 0); return; } } NDPI_LOG(NDPI_PROTOCOL_LISP, ndpi_struct, NDPI_LOG_DEBUG, "exclude lisp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_LISP); } void ndpi_search_lisp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_LISP, ndpi_struct, NDPI_LOG_DEBUG, "lisp detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_LISP) { ndpi_check_lisp(ndpi_struct, flow); } } void init_lisp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("LISP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_LISP, ndpi_search_lisp, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/lotus_notes.c000066400000000000000000000056361321103654100202600ustar00rootroot00000000000000/* * lotus_notes.c * * Copyright (C) 2012-15 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_LOTUS_NOTES /* ************************************ */ static void ndpi_check_lotus_notes(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if(packet->tcp != NULL) { flow->l4.tcp.lotus_notes_packet_id++; if((flow->l4.tcp.lotus_notes_packet_id == 1) /* We have seen the 3-way handshake */ && flow->l4.tcp.seen_syn && flow->l4.tcp.seen_syn_ack && flow->l4.tcp.seen_ack) { if(payload_len > 16) { char lotus_notes_header[] = { 0x00, 0x00, 0x02, 0x00, 0x00, 0x40, 0x02, 0x0F }; if(memcmp(&packet->payload[6], lotus_notes_header, sizeof(lotus_notes_header)) == 0) { NDPI_LOG(NDPI_PROTOCOL_LOTUS_NOTES, ndpi_struct, NDPI_LOG_DEBUG, "Found lotus_notes.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_LOTUS_NOTES, NDPI_PROTOCOL_UNKNOWN); } return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_LOTUS_NOTES); } else if(flow->l4.tcp.lotus_notes_packet_id > 3) NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_LOTUS_NOTES); return; } } void ndpi_search_lotus_notes(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_LOTUS_NOTES, ndpi_struct, NDPI_LOG_DEBUG, "lotus_notes detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_LOTUS_NOTES) ndpi_check_lotus_notes(ndpi_struct, flow); } void init_lotus_notes_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("LotusNotes", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_LOTUS_NOTES, ndpi_search_lotus_notes, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mail_imap.c000066400000000000000000000421111321103654100176170ustar00rootroot00000000000000/* * mail_imap.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MAIL_IMAP static void ndpi_int_mail_imap_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAIL_IMAP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_mail_imap_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t i = 0; u_int16_t space_pos = 0; u_int16_t command_start = 0; u_int8_t saw_command = 0; /* const u_int8_t *command = 0; */ NDPI_LOG(NDPI_PROTOCOL_MAIL_IMAP, ndpi_struct, NDPI_LOG_DEBUG, "search IMAP.\n"); if (flow->l4.tcp.mail_imap_starttls == 2) { #ifdef NDPI_PROTOCOL_SSL NDPI_LOG(NDPI_PROTOCOL_MAIL_IMAP, ndpi_struct, NDPI_LOG_DEBUG, "starttls detected\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MAIL_IMAP); NDPI_DEL_PROTOCOL_FROM_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SSL); return; #endif } if (packet->payload_packet_len >= 4 && ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a) { // the DONE command appears without a tag if (packet->payload_packet_len == 6 && ((packet->payload[0] == 'D' || packet->payload[0] == 'd') && (packet->payload[1] == 'O' || packet->payload[1] == 'o') && (packet->payload[2] == 'N' || packet->payload[2] == 'n') && (packet->payload[3] == 'E' || packet->payload[3] == 'e'))) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else { if (flow->l4.tcp.mail_imap_stage < 4) { // search for the first space character (end of the tag) while (i < 20 && i < packet->payload_packet_len) { if (i > 0 && packet->payload[i] == ' ') { space_pos = i; break; } if (!((packet->payload[i] >= 'a' && packet->payload[i] <= 'z') || (packet->payload[i] >= 'A' && packet->payload[i] <= 'Z') || (packet->payload[i] >= '0' && packet->payload[i] <= '9') || packet->payload[i] == '*' || packet->payload[i] == '.')) { goto imap_excluded; } i++; } if (space_pos == 0 || space_pos == (packet->payload_packet_len - 1)) { goto imap_excluded; } // now walk over a possible mail number to the next space i++; if (i < packet->payload_packet_len && (packet->payload[i] >= '0' && packet->payload[i] <= '9')) { while (i < 20 && i < packet->payload_packet_len) { if (i > 0 && packet->payload[i] == ' ') { space_pos = i; break; } if (!(packet->payload[i] >= '0' && packet->payload[i] <= '9')) { goto imap_excluded; } i++; } if (space_pos == 0 || space_pos == (packet->payload_packet_len - 1)) { goto imap_excluded; } } command_start = space_pos + 1; /* command = &(packet->payload[command_start]); */ } else { command_start = 0; /* command = &(packet->payload[command_start]); */ } if ((command_start + 3) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'O' || packet->payload[command_start] == 'o') && (packet->payload[command_start + 1] == 'K' || packet->payload[command_start + 1] == 'k') && packet->payload[command_start + 2] == ' ') { flow->l4.tcp.mail_imap_stage += 1; if (flow->l4.tcp.mail_imap_starttls == 1) flow->l4.tcp.mail_imap_starttls = 2; saw_command = 1; } else if ((packet->payload[command_start] == 'U' || packet->payload[command_start] == 'u') && (packet->payload[command_start + 1] == 'I' || packet->payload[command_start + 1] == 'i') && (packet->payload[command_start + 2] == 'D' || packet->payload[command_start + 2] == 'd')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } } if ((command_start + 10) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'C' || packet->payload[command_start] == 'c') && (packet->payload[command_start + 1] == 'A' || packet->payload[command_start + 1] == 'a') && (packet->payload[command_start + 2] == 'P' || packet->payload[command_start + 2] == 'p') && (packet->payload[command_start + 3] == 'A' || packet->payload[command_start + 3] == 'a') && (packet->payload[command_start + 4] == 'B' || packet->payload[command_start + 4] == 'b') && (packet->payload[command_start + 5] == 'I' || packet->payload[command_start + 5] == 'i') && (packet->payload[command_start + 6] == 'L' || packet->payload[command_start + 6] == 'l') && (packet->payload[command_start + 7] == 'I' || packet->payload[command_start + 7] == 'i') && (packet->payload[command_start + 8] == 'T' || packet->payload[command_start + 8] == 't') && (packet->payload[command_start + 9] == 'Y' || packet->payload[command_start + 9] == 'y')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } } if ((command_start + 8) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'S' || packet->payload[command_start] == 's') && (packet->payload[command_start + 1] == 'T' || packet->payload[command_start + 1] == 't') && (packet->payload[command_start + 2] == 'A' || packet->payload[command_start + 2] == 'a') && (packet->payload[command_start + 3] == 'R' || packet->payload[command_start + 3] == 'r') && (packet->payload[command_start + 4] == 'T' || packet->payload[command_start + 4] == 't') && (packet->payload[command_start + 5] == 'T' || packet->payload[command_start + 5] == 't') && (packet->payload[command_start + 6] == 'L' || packet->payload[command_start + 6] == 'l') && (packet->payload[command_start + 7] == 'S' || packet->payload[command_start + 7] == 's')) { flow->l4.tcp.mail_imap_stage += 1; flow->l4.tcp.mail_imap_starttls = 1; flow->detected_protocol_stack[0] = NDPI_PROTOCOL_MAIL_IMAPS; saw_command = 1; } } if ((command_start + 5) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'L' || packet->payload[command_start] == 'l') && (packet->payload[command_start + 1] == 'O' || packet->payload[command_start + 1] == 'o') && (packet->payload[command_start + 2] == 'G' || packet->payload[command_start + 2] == 'g') && (packet->payload[command_start + 3] == 'I' || packet->payload[command_start + 3] == 'i') && (packet->payload[command_start + 4] == 'N' || packet->payload[command_start + 4] == 'n')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'F' || packet->payload[command_start] == 'f') && (packet->payload[command_start + 1] == 'E' || packet->payload[command_start + 1] == 'e') && (packet->payload[command_start + 2] == 'T' || packet->payload[command_start + 2] == 't') && (packet->payload[command_start + 3] == 'C' || packet->payload[command_start + 3] == 'c') && (packet->payload[command_start + 4] == 'H' || packet->payload[command_start + 4] == 'h')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'F' || packet->payload[command_start] == 'f') && (packet->payload[command_start + 1] == 'L' || packet->payload[command_start + 1] == 'l') && (packet->payload[command_start + 2] == 'A' || packet->payload[command_start + 2] == 'a') && (packet->payload[command_start + 3] == 'G' || packet->payload[command_start + 3] == 'g') && (packet->payload[command_start + 4] == 'S' || packet->payload[command_start + 4] == 's')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'C' || packet->payload[command_start] == 'c') && (packet->payload[command_start + 1] == 'H' || packet->payload[command_start + 1] == 'h') && (packet->payload[command_start + 2] == 'E' || packet->payload[command_start + 2] == 'e') && (packet->payload[command_start + 3] == 'C' || packet->payload[command_start + 3] == 'c') && (packet->payload[command_start + 4] == 'K' || packet->payload[command_start + 4] == 'k')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'S' || packet->payload[command_start] == 's') && (packet->payload[command_start + 1] == 'T' || packet->payload[command_start + 1] == 't') && (packet->payload[command_start + 2] == 'O' || packet->payload[command_start + 2] == 'o') && (packet->payload[command_start + 3] == 'R' || packet->payload[command_start + 3] == 'r') && (packet->payload[command_start + 4] == 'E' || packet->payload[command_start + 4] == 'e')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } } if ((command_start + 12) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'A' || packet->payload[command_start] == 'a') && (packet->payload[command_start + 1] == 'U' || packet->payload[command_start + 1] == 'u') && (packet->payload[command_start + 2] == 'T' || packet->payload[command_start + 2] == 't') && (packet->payload[command_start + 3] == 'H' || packet->payload[command_start + 3] == 'h') && (packet->payload[command_start + 4] == 'E' || packet->payload[command_start + 4] == 'e') && (packet->payload[command_start + 5] == 'N' || packet->payload[command_start + 5] == 'n') && (packet->payload[command_start + 6] == 'T' || packet->payload[command_start + 6] == 't') && (packet->payload[command_start + 7] == 'I' || packet->payload[command_start + 7] == 'i') && (packet->payload[command_start + 8] == 'C' || packet->payload[command_start + 8] == 'c') && (packet->payload[command_start + 9] == 'A' || packet->payload[command_start + 9] == 'a') && (packet->payload[command_start + 10] == 'T' || packet->payload[command_start + 10] == 't') && (packet->payload[command_start + 11] == 'E' || packet->payload[command_start + 11] == 'e')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } } if ((command_start + 9) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'N' || packet->payload[command_start] == 'n') && (packet->payload[command_start + 1] == 'A' || packet->payload[command_start + 1] == 'a') && (packet->payload[command_start + 2] == 'M' || packet->payload[command_start + 2] == 'm') && (packet->payload[command_start + 3] == 'E' || packet->payload[command_start + 3] == 'e') && (packet->payload[command_start + 4] == 'S' || packet->payload[command_start + 4] == 's') && (packet->payload[command_start + 5] == 'P' || packet->payload[command_start + 5] == 'p') && (packet->payload[command_start + 6] == 'A' || packet->payload[command_start + 6] == 'a') && (packet->payload[command_start + 7] == 'C' || packet->payload[command_start + 7] == 'c') && (packet->payload[command_start + 8] == 'E' || packet->payload[command_start + 8] == 'e')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } } if ((command_start + 4) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'L' || packet->payload[command_start] == 'l') && (packet->payload[command_start + 1] == 'S' || packet->payload[command_start + 1] == 's') && (packet->payload[command_start + 2] == 'U' || packet->payload[command_start + 2] == 'u') && (packet->payload[command_start + 3] == 'B' || packet->payload[command_start + 3] == 'b')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'L' || packet->payload[command_start] == 'l') && (packet->payload[command_start + 1] == 'I' || packet->payload[command_start + 1] == 'i') && (packet->payload[command_start + 2] == 'S' || packet->payload[command_start + 2] == 's') && (packet->payload[command_start + 3] == 'T' || packet->payload[command_start + 3] == 't')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'N' || packet->payload[command_start] == 'n') && (packet->payload[command_start + 1] == 'O' || packet->payload[command_start + 1] == 'o') && (packet->payload[command_start + 2] == 'O' || packet->payload[command_start + 2] == 'o') && (packet->payload[command_start + 3] == 'P' || packet->payload[command_start + 3] == 'p')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'I' || packet->payload[command_start] == 'i') && (packet->payload[command_start + 1] == 'D' || packet->payload[command_start + 1] == 'd') && (packet->payload[command_start + 2] == 'L' || packet->payload[command_start + 2] == 'l') && (packet->payload[command_start + 3] == 'E' || packet->payload[command_start + 3] == 'e')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } } if ((command_start + 6) < packet->payload_packet_len) { if ((packet->payload[command_start] == 'S' || packet->payload[command_start] == 's') && (packet->payload[command_start + 1] == 'E' || packet->payload[command_start + 1] == 'e') && (packet->payload[command_start + 2] == 'L' || packet->payload[command_start + 2] == 'l') && (packet->payload[command_start + 3] == 'E' || packet->payload[command_start + 3] == 'e') && (packet->payload[command_start + 4] == 'C' || packet->payload[command_start + 4] == 'c') && (packet->payload[command_start + 5] == 'T' || packet->payload[command_start + 5] == 't')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'E' || packet->payload[command_start] == 'e') && (packet->payload[command_start + 1] == 'X' || packet->payload[command_start + 1] == 'x') && (packet->payload[command_start + 2] == 'I' || packet->payload[command_start + 2] == 'i') && (packet->payload[command_start + 3] == 'S' || packet->payload[command_start + 3] == 's') && (packet->payload[command_start + 4] == 'T' || packet->payload[command_start + 4] == 't') && (packet->payload[command_start + 5] == 'S' || packet->payload[command_start + 5] == 's')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } else if ((packet->payload[command_start] == 'A' || packet->payload[command_start] == 'a') && (packet->payload[command_start + 1] == 'P' || packet->payload[command_start + 1] == 'p') && (packet->payload[command_start + 2] == 'P' || packet->payload[command_start + 2] == 'p') && (packet->payload[command_start + 3] == 'E' || packet->payload[command_start + 3] == 'e') && (packet->payload[command_start + 4] == 'N' || packet->payload[command_start + 4] == 'n') && (packet->payload[command_start + 5] == 'D' || packet->payload[command_start + 5] == 'd')) { flow->l4.tcp.mail_imap_stage += 1; saw_command = 1; } } } if (saw_command == 1) { if (flow->l4.tcp.mail_imap_stage == 3 || flow->l4.tcp.mail_imap_stage == 5) { NDPI_LOG(NDPI_PROTOCOL_MAIL_IMAP, ndpi_struct, NDPI_LOG_DEBUG, "mail imap identified\n"); ndpi_int_mail_imap_add_connection(ndpi_struct, flow); return; } } } if (packet->payload_packet_len > 1 && packet->payload[packet->payload_packet_len - 1] == ' ') { NDPI_LOG(NDPI_PROTOCOL_MAIL_IMAP, ndpi_struct, NDPI_LOG_DEBUG, "maybe a split imap command -> need next packet and imap_stage is set to 4.\n"); flow->l4.tcp.mail_imap_stage = 4; return; } imap_excluded: // skip over possible authentication hashes etc. that cannot be identified as imap commands or responses // if the packet count is low enough and at least one command or response was seen before if ((packet->payload_packet_len >= 2 && ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a) && flow->packet_counter < 6 && flow->l4.tcp.mail_imap_stage >= 1) { NDPI_LOG(NDPI_PROTOCOL_MAIL_IMAP, ndpi_struct, NDPI_LOG_DEBUG, "no imap command or response but packet count < 6 and imap stage >= 1 -> skip\n"); return; } NDPI_LOG(NDPI_PROTOCOL_MAIL_IMAP, ndpi_struct, NDPI_LOG_DEBUG, "exclude IMAP.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MAIL_IMAP); } void init_mail_imap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MAIL_IMAP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MAIL_IMAP, ndpi_search_mail_imap_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mail_pop.c000066400000000000000000000210251321103654100174700ustar00rootroot00000000000000/* * mail_pop.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MAIL_POP #define POP_BIT_AUTH 0x0001 #define POP_BIT_APOP 0x0002 #define POP_BIT_USER 0x0004 #define POP_BIT_PASS 0x0008 #define POP_BIT_CAPA 0x0010 #define POP_BIT_LIST 0x0020 #define POP_BIT_STAT 0x0040 #define POP_BIT_UIDL 0x0080 #define POP_BIT_RETR 0x0100 #define POP_BIT_DELE 0x0200 #define POP_BIT_STLS 0x0400 static void ndpi_int_mail_pop_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAIL_POP, NDPI_PROTOCOL_UNKNOWN); } static int ndpi_int_mail_pop_check_for_client_commands(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len > 4) { if ((packet->payload[0] == 'A' || packet->payload[0] == 'a') && (packet->payload[1] == 'U' || packet->payload[1] == 'u') && (packet->payload[2] == 'T' || packet->payload[2] == 't') && (packet->payload[3] == 'H' || packet->payload[3] == 'h')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_AUTH; return 1; } else if ((packet->payload[0] == 'A' || packet->payload[0] == 'a') && (packet->payload[1] == 'P' || packet->payload[1] == 'p') && (packet->payload[2] == 'O' || packet->payload[2] == 'o') && (packet->payload[3] == 'P' || packet->payload[3] == 'p')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_APOP; return 1; } else if ((packet->payload[0] == 'U' || packet->payload[0] == 'u') && (packet->payload[1] == 'S' || packet->payload[1] == 's') && (packet->payload[2] == 'E' || packet->payload[2] == 'e') && (packet->payload[3] == 'R' || packet->payload[3] == 'r')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_USER; return 1; } else if ((packet->payload[0] == 'P' || packet->payload[0] == 'p') && (packet->payload[1] == 'A' || packet->payload[1] == 'a') && (packet->payload[2] == 'S' || packet->payload[2] == 's') && (packet->payload[3] == 'S' || packet->payload[3] == 's')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_PASS; return 1; } else if ((packet->payload[0] == 'C' || packet->payload[0] == 'c') && (packet->payload[1] == 'A' || packet->payload[1] == 'a') && (packet->payload[2] == 'P' || packet->payload[2] == 'p') && (packet->payload[3] == 'A' || packet->payload[3] == 'a')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_CAPA; return 1; } else if ((packet->payload[0] == 'L' || packet->payload[0] == 'l') && (packet->payload[1] == 'I' || packet->payload[1] == 'i') && (packet->payload[2] == 'S' || packet->payload[2] == 's') && (packet->payload[3] == 'T' || packet->payload[3] == 't')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_LIST; return 1; } else if ((packet->payload[0] == 'S' || packet->payload[0] == 's') && (packet->payload[1] == 'T' || packet->payload[1] == 't') && (packet->payload[2] == 'A' || packet->payload[2] == 'a') && (packet->payload[3] == 'T' || packet->payload[3] == 't')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_STAT; return 1; } else if ((packet->payload[0] == 'U' || packet->payload[0] == 'u') && (packet->payload[1] == 'I' || packet->payload[1] == 'i') && (packet->payload[2] == 'D' || packet->payload[2] == 'd') && (packet->payload[3] == 'L' || packet->payload[3] == 'l')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_UIDL; return 1; } else if ((packet->payload[0] == 'R' || packet->payload[0] == 'r') && (packet->payload[1] == 'E' || packet->payload[1] == 'e') && (packet->payload[2] == 'T' || packet->payload[2] == 't') && (packet->payload[3] == 'R' || packet->payload[3] == 'r')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_RETR; return 1; } else if ((packet->payload[0] == 'D' || packet->payload[0] == 'd') && (packet->payload[1] == 'E' || packet->payload[1] == 'e') && (packet->payload[2] == 'L' || packet->payload[2] == 'l') && (packet->payload[3] == 'E' || packet->payload[3] == 'e')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_DELE; return 1; } else if ((packet->payload[0] == 'S' || packet->payload[0] == 's') && (packet->payload[1] == 'T' || packet->payload[1] == 't') && (packet->payload[2] == 'L' || packet->payload[2] == 'l') && (packet->payload[3] == 'S' || packet->payload[3] == 's')) { flow->l4.tcp.pop_command_bitmask |= POP_BIT_STLS; return 1; } } return 0; } void ndpi_search_mail_pop_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int8_t a = 0; u_int8_t bit_count = 0; NDPI_LOG(NDPI_PROTOCOL_MAIL_POP, ndpi_struct, NDPI_LOG_DEBUG, "search mail_pop\n"); if ((packet->payload_packet_len > 3 && (packet->payload[0] == '+' && (packet->payload[1] == 'O' || packet->payload[1] == 'o') && (packet->payload[2] == 'K' || packet->payload[2] == 'k'))) || (packet->payload_packet_len > 4 && (packet->payload[0] == '-' && (packet->payload[1] == 'E' || packet->payload[1] == 'e') && (packet->payload[2] == 'R' || packet->payload[2] == 'r') && (packet->payload[3] == 'R' || packet->payload[3] == 'r')))) { // +OK or -ERR seen flow->l4.tcp.mail_pop_stage += 1; } else if (!ndpi_int_mail_pop_check_for_client_commands(ndpi_struct, flow)) { goto maybe_split_pop; } if (packet->payload_packet_len > 2 && ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a) { // count the bits set in the bitmask if (flow->l4.tcp.pop_command_bitmask != 0) { for (a = 0; a < 16; a++) { bit_count += (flow->l4.tcp.pop_command_bitmask >> a) & 0x01; } } NDPI_LOG(NDPI_PROTOCOL_MAIL_POP, ndpi_struct, NDPI_LOG_DEBUG, "mail_pop +OK/-ERR responses: %u, unique commands: %u\n", flow->l4.tcp.mail_pop_stage, bit_count); if ((bit_count + flow->l4.tcp.mail_pop_stage) >= 3) { if (flow->l4.tcp.mail_pop_stage > 0) { NDPI_LOG(NDPI_PROTOCOL_MAIL_POP, ndpi_struct, NDPI_LOG_DEBUG, "mail_pop identified\n"); ndpi_int_mail_pop_add_connection(ndpi_struct, flow); return; } else { return; } } else { return; } } else { // first part of a split packet NDPI_LOG(NDPI_PROTOCOL_MAIL_POP, ndpi_struct, NDPI_LOG_DEBUG, "mail_pop command without line ending -> skip\n"); return; } maybe_split_pop: if (((packet->payload_packet_len > 2 && ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a) || flow->l4.tcp.pop_command_bitmask != 0 || flow->l4.tcp.mail_pop_stage != 0) && flow->packet_counter < 12) { // maybe part of a split pop packet NDPI_LOG(NDPI_PROTOCOL_MAIL_POP, ndpi_struct, NDPI_LOG_DEBUG, "maybe part of split mail_pop packet -> skip\n"); return; } NDPI_LOG(NDPI_PROTOCOL_MAIL_POP, ndpi_struct, NDPI_LOG_DEBUG, "exclude mail_pop\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MAIL_POP); } void init_mail_pop_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MAIL_POP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MAIL_POP, ndpi_search_mail_pop_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mail_smtp.c000066400000000000000000000201201321103654100176500ustar00rootroot00000000000000/* * mail_smtp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MAIL_SMTP #define SMTP_BIT_220 0x01 #define SMTP_BIT_250 0x02 #define SMTP_BIT_235 0x04 #define SMTP_BIT_334 0x08 #define SMTP_BIT_354 0x10 #define SMTP_BIT_HELO_EHLO 0x20 #define SMTP_BIT_MAIL 0x40 #define SMTP_BIT_RCPT 0x80 #define SMTP_BIT_AUTH 0x100 #define SMTP_BIT_STARTTLS 0x200 #define SMTP_BIT_DATA 0x400 #define SMTP_BIT_NOOP 0x800 #define SMTP_BIT_RSET 0x1000 #define SMTP_BIT_TlRM 0x2000 static void ndpi_int_mail_smtp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAIL_SMTP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_mail_smtp_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_MAIL_SMTP, ndpi_struct, NDPI_LOG_DEBUG, "search mail_smtp.\n"); if (packet->payload_packet_len > 2 && ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a) { u_int8_t a; u_int8_t bit_count = 0; NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct, flow,packet); for (a = 0; a < packet->parsed_lines; a++) { // expected server responses if (packet->line[a].len >= 3) { if (memcmp(packet->line[a].ptr, "220", 3) == 0) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_220; } else if (memcmp(packet->line[a].ptr, "250", 3) == 0) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_250; } else if (memcmp(packet->line[a].ptr, "235", 3) == 0) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_235; } else if (memcmp(packet->line[a].ptr, "334", 3) == 0) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_334; } else if (memcmp(packet->line[a].ptr, "354", 3) == 0) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_354; } } // expected client requests if (packet->line[a].len >= 5) { if ((((packet->line[a].ptr[0] == 'H' || packet->line[a].ptr[0] == 'h') && (packet->line[a].ptr[1] == 'E' || packet->line[a].ptr[1] == 'e')) || ((packet->line[a].ptr[0] == 'E' || packet->line[a].ptr[0] == 'e') && (packet->line[a].ptr[1] == 'H' || packet->line[a].ptr[1] == 'h'))) && (packet->line[a].ptr[2] == 'L' || packet->line[a].ptr[2] == 'l') && (packet->line[a].ptr[3] == 'O' || packet->line[a].ptr[3] == 'o') && packet->line[a].ptr[4] == ' ') { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_HELO_EHLO; } else if ((packet->line[a].ptr[0] == 'M' || packet->line[a].ptr[0] == 'm') && (packet->line[a].ptr[1] == 'A' || packet->line[a].ptr[1] == 'a') && (packet->line[a].ptr[2] == 'I' || packet->line[a].ptr[2] == 'i') && (packet->line[a].ptr[3] == 'L' || packet->line[a].ptr[3] == 'l') && packet->line[a].ptr[4] == ' ') { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_MAIL; } else if ((packet->line[a].ptr[0] == 'R' || packet->line[a].ptr[0] == 'r') && (packet->line[a].ptr[1] == 'C' || packet->line[a].ptr[1] == 'c') && (packet->line[a].ptr[2] == 'P' || packet->line[a].ptr[2] == 'p') && (packet->line[a].ptr[3] == 'T' || packet->line[a].ptr[3] == 't') && packet->line[a].ptr[4] == ' ') { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_RCPT; } else if ((packet->line[a].ptr[0] == 'A' || packet->line[a].ptr[0] == 'a') && (packet->line[a].ptr[1] == 'U' || packet->line[a].ptr[1] == 'u') && (packet->line[a].ptr[2] == 'T' || packet->line[a].ptr[2] == 't') && (packet->line[a].ptr[3] == 'H' || packet->line[a].ptr[3] == 'h') && packet->line[a].ptr[4] == ' ') { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_AUTH; } } if (packet->line[a].len >= 8) { if ((packet->line[a].ptr[0] == 'S' || packet->line[a].ptr[0] == 's') && (packet->line[a].ptr[1] == 'T' || packet->line[a].ptr[1] == 't') && (packet->line[a].ptr[2] == 'A' || packet->line[a].ptr[2] == 'a') && (packet->line[a].ptr[3] == 'R' || packet->line[a].ptr[3] == 'r') && (packet->line[a].ptr[4] == 'T' || packet->line[a].ptr[4] == 't') && (packet->line[a].ptr[5] == 'T' || packet->line[a].ptr[5] == 't') && (packet->line[a].ptr[6] == 'L' || packet->line[a].ptr[6] == 'l') && (packet->line[a].ptr[7] == 'S' || packet->line[a].ptr[7] == 's')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_STARTTLS; } } if (packet->line[a].len >= 4) { if ((packet->line[a].ptr[0] == 'D' || packet->line[a].ptr[0] == 'd') && (packet->line[a].ptr[1] == 'A' || packet->line[a].ptr[1] == 'a') && (packet->line[a].ptr[2] == 'T' || packet->line[a].ptr[2] == 't') && (packet->line[a].ptr[3] == 'A' || packet->line[a].ptr[3] == 'a')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_DATA; } else if ((packet->line[a].ptr[0] == 'N' || packet->line[a].ptr[0] == 'n') && (packet->line[a].ptr[1] == 'O' || packet->line[a].ptr[1] == 'o') && (packet->line[a].ptr[2] == 'O' || packet->line[a].ptr[2] == 'o') && (packet->line[a].ptr[3] == 'P' || packet->line[a].ptr[3] == 'p')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_NOOP; } else if ((packet->line[a].ptr[0] == 'R' || packet->line[a].ptr[0] == 'r') && (packet->line[a].ptr[1] == 'S' || packet->line[a].ptr[1] == 's') && (packet->line[a].ptr[2] == 'E' || packet->line[a].ptr[2] == 'e') && (packet->line[a].ptr[3] == 'T' || packet->line[a].ptr[3] == 't')) { flow->l4.tcp.smtp_command_bitmask |= SMTP_BIT_RSET; } } } // now count the bits set in the bitmask if (flow->l4.tcp.smtp_command_bitmask != 0) { for (a = 0; a < 16; a++) { bit_count += (flow->l4.tcp.smtp_command_bitmask >> a) & 0x01; } } NDPI_LOG(NDPI_PROTOCOL_MAIL_SMTP, ndpi_struct, NDPI_LOG_DEBUG, "seen smtp commands and responses: %u.\n", bit_count); if (bit_count >= 3) { NDPI_LOG(NDPI_PROTOCOL_MAIL_SMTP, ndpi_struct, NDPI_LOG_DEBUG, "mail smtp identified\n"); ndpi_int_mail_smtp_add_connection(ndpi_struct, flow); return; } if (bit_count >= 1 && flow->packet_counter < 12) { return; } } /* when the first or second packets are split into two packets, those packets are ignored. */ if (flow->packet_counter <= 4 && packet->payload_packet_len >= 4 && (ntohs(get_u_int16_t(packet->payload, packet->payload_packet_len - 2)) == 0x0d0a || memcmp(packet->payload, "220", 3) == 0 || memcmp(packet->payload, "EHLO", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_MAIL_SMTP, ndpi_struct, NDPI_LOG_DEBUG, "maybe SMTP, need next packet.\n"); return; } NDPI_LOG(NDPI_PROTOCOL_MAIL_SMTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude smtp\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MAIL_SMTP); } void init_mail_smtp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MAIL_SMTP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MAIL_SMTP, ndpi_search_mail_smtp_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/maplestory.c000066400000000000000000000102171321103654100200700ustar00rootroot00000000000000/* * maplestory.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_MAPLESTORY static void ndpi_int_maplestory_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MAPLESTORY, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_maplestory(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len == 16 && (ntohl(get_u_int32_t(packet->payload, 0)) == 0x0e003a00 || ntohl(get_u_int32_t(packet->payload, 0)) == 0x0e003b00 || ntohl(get_u_int32_t(packet->payload, 0)) == 0x0e004200) && ntohs(get_u_int16_t(packet->payload, 4)) == 0x0100 && (packet->payload[6] == 0x32 || packet->payload[6] == 0x33)) { NDPI_LOG(NDPI_PROTOCOL_MAPLESTORY, ndpi_struct, NDPI_LOG_DEBUG, "found maplestory.\n"); ndpi_int_maplestory_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /maple") && memcmp(packet->payload, "GET /maple", NDPI_STATICSTRING_LEN("GET /maple")) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); /* Maplestory update */ if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /maple/patch") && packet->payload[NDPI_STATICSTRING_LEN("GET /maple")] == '/') { if (packet->user_agent_line.ptr != NULL && packet->host_line.ptr != NULL && packet->user_agent_line.len == NDPI_STATICSTRING_LEN("Patcher") && packet->host_line.len > NDPI_STATICSTRING_LEN("patch.") && memcmp(&packet->payload[NDPI_STATICSTRING_LEN("GET /maple/")], "patch", NDPI_STATICSTRING_LEN("patch")) == 0 && memcmp(packet->user_agent_line.ptr, "Patcher", NDPI_STATICSTRING_LEN("Patcher")) == 0 && memcmp(packet->host_line.ptr, "patch.", NDPI_STATICSTRING_LEN("patch.")) == 0) { NDPI_LOG(NDPI_PROTOCOL_MAPLESTORY, ndpi_struct, NDPI_LOG_DEBUG, "found maplestory update.\n"); ndpi_int_maplestory_add_connection(ndpi_struct, flow); return; } } else if (packet->user_agent_line.ptr != NULL && packet->user_agent_line.len == NDPI_STATICSTRING_LEN("AspINet") && memcmp(&packet->payload[NDPI_STATICSTRING_LEN("GET /maple")], "story/", NDPI_STATICSTRING_LEN("story/")) == 0 && memcmp(packet->user_agent_line.ptr, "AspINet", NDPI_STATICSTRING_LEN("AspINet")) == 0) { NDPI_LOG(NDPI_PROTOCOL_MAPLESTORY, ndpi_struct, NDPI_LOG_DEBUG, "found maplestory update.\n"); ndpi_int_maplestory_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_MAPLESTORY, ndpi_struct, NDPI_LOG_DEBUG, "exclude maplestory.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MAPLESTORY); } void init_maplestory_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MapleStory", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MAPLESTORY, ndpi_search_maplestory, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mdns.c000066400000000000000000000124051321103654100166330ustar00rootroot00000000000000/* * mdns.c * * Copyright (C) 2016-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MDNS #define NDPI_MAX_MDNS_REQUESTS 128 PACK_ON struct mdns_header { u_int16_t transaction_id, flags, questions, answers, authority_rr, additional_rr; } PACK_OFF; /** MDNS header is similar to dns header 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | ID = 0x0000 | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | FLAGS | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | QDCOUNT | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | ANCOUNT | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | NSCOUNT | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ | ARCOUNT | +--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+ */ static void ndpi_int_mdns_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MDNS, NDPI_PROTOCOL_UNKNOWN); } static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct mdns_header *h = (struct mdns_header*)packet->payload; u_int16_t questions = ntohs(h->questions), answers = ntohs(h->answers); if(((packet->payload[2] & 0x80) == 0) && (questions <= NDPI_MAX_MDNS_REQUESTS) && (answers <= NDPI_MAX_MDNS_REQUESTS)) { NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n"); return 1; } else if(((packet->payload[2] & 0x80) != 0) && (questions == 0) && (answers <= NDPI_MAX_MDNS_REQUESTS) && (answers != 0)) { char answer[256]; int i, j, len; for(i=13, j=0; (packet->payload[i] != 0) && (i < packet->payload_packet_len) && (i < (sizeof(answer)-1)); i++) answer[j++] = (packet->payload[i] < 13) ? '.' : packet->payload[i]; answer[j] = '\0'; /* printf("==> [%d] %s\n", j, answer); */ len = ndpi_min(sizeof(flow->protos.mdns.answer)-1, j); strncpy(flow->protos.mdns.answer, (const char *)answer, len); flow->protos.mdns.answer[len] = '\0'; NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with answer query.\n"); return 1; } return 0; } void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport; /** information from http://www.it-administrator.de/lexikon/multicast-dns.html */ /* check if UDP packet */ if(packet->udp != NULL) { /* read destination port */ dport = ntohs(packet->udp->dest); /* check standard MDNS ON port 5353 */ if(dport == 5353 && packet->payload_packet_len >= 12) { /* mdns protocol must have destination address 224.0.0.251 */ if(packet->iph != NULL /* && ntohl(packet->iph->daddr) == 0xe00000fb */) { NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n"); if(ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) { ndpi_int_mdns_add_connection(ndpi_struct, flow); return; } } #ifdef NDPI_DETECTION_SUPPORT_IPV6 if(packet->iphv6 != NULL) { const u_int32_t *daddr = packet->iphv6->ip6_dst.u6_addr.u6_addr32; if(daddr[0] == htonl(0xff020000) /* && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb) */) { NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n"); if(ndpi_int_check_mdns_payload(ndpi_struct, flow) == 1) { ndpi_int_mdns_add_connection(ndpi_struct, flow); return; } } } #endif } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MDNS); } void init_mdns_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MDNS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MDNS, ndpi_search_mdns, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/megaco.c000066400000000000000000000046731321103654100171350ustar00rootroot00000000000000/* * megaco.c * * Copyright (C) 2014 by Gianluca Costa http://www.capanalysis.net * Copyright (C) 2012-15 - ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_MEGACO void ndpi_search_megaco(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_MEGACO, ndpi_struct, NDPI_LOG_DEBUG, "search for MEGACO.\n"); if(packet->udp != NULL) { if((packet->payload_packet_len > 4 && packet->payload[0] == '!' && packet->payload[1] == '/' && packet->payload[2] == '1' && packet->payload[3] == ' ' && packet->payload[4] == '[') || (packet->payload_packet_len > 9 && packet->payload[0] == 'M' && packet->payload[1] == 'E' && packet->payload[2] == 'G' && packet->payload[3] == 'A' && packet->payload[4] == 'C' && packet->payload[5] == 'O' && packet->payload[6] == '/' && packet->payload[7] == '1' && packet->payload[8] == ' ' && packet->payload[9] == '[')) { NDPI_LOG(NDPI_PROTOCOL_MEGACO, ndpi_struct, NDPI_LOG_DEBUG, "found MEGACO.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MEGACO, NDPI_PROTOCOL_UNKNOWN); return; } } NDPI_LOG(NDPI_PROTOCOL_MEGACO, ndpi_struct, NDPI_LOG_DEBUG, "exclude MEGACO.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MEGACO); } void init_megaco_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Megaco", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MEGACO, ndpi_search_megaco, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mgcp.c000066400000000000000000000062001321103654100166140ustar00rootroot00000000000000/* * mgcp.c * * Copyright (C) 2017 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MGCP static void ndpi_int_mgcp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MGCP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_mgcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t pos = 5; if (packet->payload_packet_len < 8) { goto mgcp_excluded; } /* packet must end with 0x0d0a or with 0x0a */ if (packet->payload[packet->payload_packet_len - 1] != 0x0a) { goto mgcp_excluded; } if (packet->payload[0] != 'A' && packet->payload[0] != 'C' && packet->payload[0] != 'D' && packet->payload[0] != 'E' && packet->payload[0] != 'M' && packet->payload[0] != 'N' && packet->payload[0] != 'R') { goto mgcp_excluded; } if (memcmp(packet->payload, "AUEP ", 5) != 0 && memcmp(packet->payload, "AUCX ", 5) != 0 && memcmp(packet->payload, "CRCX ", 5) != 0 && memcmp(packet->payload, "DLCX ", 5) != 0 && memcmp(packet->payload, "EPCF ", 5) != 0 && memcmp(packet->payload, "MDCX ", 5) != 0 && memcmp(packet->payload, "NTFY ", 5) != 0 && memcmp(packet->payload, "RQNT ", 5) != 0 && memcmp(packet->payload, "RSIP ", 5) != 0) { goto mgcp_excluded; } // now search for string "MGCP " in the rest of the message while ((pos + 4) < packet->payload_packet_len) { if (memcmp(&packet->payload[pos], "MGCP ", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_MGCP, ndpi_struct, NDPI_LOG_DEBUG, "MGCP match.\n"); ndpi_int_mgcp_add_connection(ndpi_struct, flow); return; } pos++; } mgcp_excluded: NDPI_LOG(NDPI_PROTOCOL_MGCP, ndpi_struct, NDPI_LOG_DEBUG, "exclude MGCP.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MGCP); } void init_mgpc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MGCP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MGCP, ndpi_search_mgcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mms.c000066400000000000000000000065521321103654100164740ustar00rootroot00000000000000/* * mms.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_CONTENT_MMS static void ndpi_int_mms_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_CONTENT_MMS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_mms_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; /* search MSMMS packets */ if (packet->payload_packet_len >= 20) { if (flow->l4.tcp.mms_stage == 0 && packet->payload[4] == 0xce && packet->payload[5] == 0xfa && packet->payload[6] == 0x0b && packet->payload[7] == 0xb0 && packet->payload[12] == 0x4d && packet->payload[13] == 0x4d && packet->payload[14] == 0x53 && packet->payload[15] == 0x20) { NDPI_LOG(NDPI_CONTENT_MMS, ndpi_struct, NDPI_LOG_DEBUG, "MMS: MSMMS Request found \n"); flow->l4.tcp.mms_stage = 1 + packet->packet_direction; return; } if (flow->l4.tcp.mms_stage == 2 - packet->packet_direction && packet->payload[4] == 0xce && packet->payload[5] == 0xfa && packet->payload[6] == 0x0b && packet->payload[7] == 0xb0 && packet->payload[12] == 0x4d && packet->payload[13] == 0x4d && packet->payload[14] == 0x53 && packet->payload[15] == 0x20) { NDPI_LOG(NDPI_CONTENT_MMS, ndpi_struct, NDPI_LOG_DEBUG, "MMS: MSMMS Response found \n"); ndpi_int_mms_add_connection(ndpi_struct, flow); return; } } #ifdef NDPI_PROTOCOL_HTTP if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) { #endif /* NDPI_PROTOCOL_HTTP */ NDPI_LOG(NDPI_CONTENT_MMS, ndpi_struct, NDPI_LOG_DEBUG, "MMS: exclude\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_CONTENT_MMS); #ifdef NDPI_PROTOCOL_HTTP } else { NDPI_LOG(NDPI_CONTENT_MMS, ndpi_struct, NDPI_LOG_DEBUG, "MMS avoid early exclude from http\n"); } #endif /* NDPI_PROTOCOL_HTTP */ } void init_mms_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MMS", ndpi_struct, detection_bitmask, *id, NDPI_CONTENT_MMS, ndpi_search_mms_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mpegts.c000066400000000000000000000041441321103654100171720ustar00rootroot00000000000000/* * mpegts.c (MPEG Transport Stream) * https://en.wikipedia.org/wiki/MPEG_transport_stream * * Copyright (C) 2015 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_MPEGTS void ndpi_search_mpegts(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_MPEGTS, ndpi_struct, NDPI_LOG_DEBUG, "search for MPEGTS.\n"); if((packet->udp != NULL) && ((packet->payload_packet_len % 188) == 0)) { u_int i, num_chunks = packet->payload_packet_len / 188; for(i=0; ipayload[offset] != 0x47) goto no_mpegts; } /* This looks MPEG TS */ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MPEGTS, NDPI_PROTOCOL_UNKNOWN); return; } no_mpegts: NDPI_LOG(NDPI_PROTOCOL_MPEGTS, ndpi_struct, NDPI_LOG_DEBUG, "Excluded MPEGTS.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MPEGTS); } void init_mpegts_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MPEG_TS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MPEGTS, ndpi_search_mpegts, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mqtt.c000066400000000000000000000254571321103654100166720ustar00rootroot00000000000000/* * mqtt.c * * Copyright (C) 2016 Sorin Zamfir * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MQTT /** * The type of control messages in mqtt version 3.1.1 * see http://docs.oasis-open.org/mqtt/mqtt/v3.1.1 */ enum MQTT_PACKET_TYPES { CONNECT = 1, CONNACK = 2, PUBLISH = 3, PUBACK = 4, PUBREC = 5, PUBREL = 6, PUBCOMP = 7, SUBSCRIBE = 8, SUBACK = 9, UNSUBSCRIBE = 10, UNSUBACK = 11, PINGREQ = 12, PINGRESP = 13, DISCONNECT = 14 }; /** * Entry point when protocol is identified. */ static void ndpi_int_mqtt_add_connection (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_MQTT,NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found.\n"); } /** * Dissector function that searches Mqtt headers */ void ndpi_search_mqtt (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt search called...\n"); struct ndpi_packet_struct *packet = &flow->packet; if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { return; } NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt detection...\n"); if (flow->packet_counter > 10) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. mandatory header not found!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> Mqtt header: %4x%4x%4x%4x [len: %u]\n", packet->payload[0], packet->payload[1], packet->payload[2], packet->payload[3], packet->payload_packet_len); if (packet->payload_packet_len < 2) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. mandatory header not found!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } if (packet->payload_packet_len > 258) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. maximum packet size exceeded!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } // we extract the remaining length u_int8_t rl = (u_int8_t) (packet->payload[1]); if (packet->payload_packet_len != (rl + 2)) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. packet size exceeded!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } // we extract the packet type u_int8_t pt = (u_int8_t) ((packet->payload[0] & 0xF0) >> 4); NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Mqtt packet type: [%d]\n",pt); if ((pt == 0) || (pt == 15)) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt .. invalid packet type!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } // we extract the flags u_int8_t flags = (u_int8_t) (packet->payload[0] & 0x0F); NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Mqtt flags type: [%d]\n",flags); // first stage verification if (((pt == CONNECT) || (pt == CONNACK) || (pt == PUBACK) || (pt == PUBREC) || (pt == PUBCOMP) || (pt == SUBACK) || (pt == UNSUBACK) || (pt == PINGREQ) || (pt == PINGRESP) || (pt == DISCONNECT)) && (flags > 0)) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Flag combination flag!=0\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } if (((pt == PUBREL) || (pt == SUBSCRIBE) || (pt == UNSUBSCRIBE)) && (flags != 2)) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Flag combination flag!=2\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Passed first stage of identification\n"); // second stage verification (no payload, just variable headers) if ((pt == CONNACK) || (pt == PUBACK) || (pt == PUBREL) || (pt == PUBREC) || (pt == PUBCOMP) || (pt == UNSUBACK)) { if (packet->payload_packet_len != 4) { // these packets are always 4 bytes long NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Length < 4 \n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } else { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found CONNACK/PUBACK/PUBREL/PUBREC/PUBCOMP/UNSUBACK\n"); ndpi_int_mqtt_add_connection(ndpi_struct,flow); return; } } if ((pt == PINGREQ) || (pt == PINGRESP) || (pt == DISCONNECT)) { if (packet->payload_packet_len != 2) { // these packets are always 2 bytes long NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid Packet-Length <2 \n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } else { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found PING/PINGRESP/DISCONNECT\n"); ndpi_int_mqtt_add_connection(ndpi_struct,flow); return; } } NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Passed second stage of identification\n"); // third stage verification (payload) if (pt == CONNECT) { if (packet->payload_packet_len >= 8 && memcmp(&(packet->payload[4]),"MQTT",4) == 0) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found CONNECT\n"); ndpi_int_mqtt_add_connection(ndpi_struct,flow); return; } else { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid CONNECT\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } } if (pt == PUBLISH) { // payload CAN be zero bytes length (section 3.3.3 of MQTT standard) u_int8_t qos = (u_int8_t) (flags & 0x06); u_int8_t retain = (u_int8_t) (flags & 0x01); u_int8_t dup = (u_int8_t) (flags & 0x04); if (qos > 2) { // qos values possible are 0,1,2 NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH qos\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } if (retain > 1) { // retain flag possible 0,1 NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH retain\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } if (dup > 1) { // dup flag possible 0,1 NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH dup\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } if (qos == 0) { if (dup != 0) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH qos0 and dup combination\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } if (packet->payload_packet_len < 5) { // at least topic (3Bytes + 2Bytes fixed header) NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH qos0 size\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } } if ((qos == 1) || (qos == 2)) { if (packet->payload_packet_len < 7 ) { // at least topic + pkt identifier (3Bytes + 2Bytes + 2Bytes fixed header) NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid PUBLISH qos1&2\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } } NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found PUBLISH\n"); ndpi_int_mqtt_add_connection(ndpi_struct,flow); return; } if (pt == SUBSCRIBE) { if (packet->payload_packet_len < 8) { // at least one topic+filter is required in the payload NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid SUBSCRIBE\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } else { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found SUBSCRIBE\n"); ndpi_int_mqtt_add_connection(ndpi_struct,flow); return; } } if (pt == SUBACK ) { if (packet->payload_packet_len <5 ) { // must have at least a response code NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid SUBACK\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } else { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found SUBACK\n"); ndpi_int_mqtt_add_connection(ndpi_struct,flow); return; } } if (pt == UNSUBSCRIBE) { if (packet->payload_packet_len < 7) { // at least a topic NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Excluding Mqtt invalid UNSUBSCRIBE\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } else { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt found UNSUBSCRIBE\n",pt); ndpi_int_mqtt_add_connection(ndpi_struct,flow); return; } } NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> Passed third stage of identification"); NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Reached the end excluding Mqtt ...\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MQTT); return; } /** * Entry point for the ndpi library */ void init_mqtt_dissector (struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { NDPI_LOG(NDPI_PROTOCOL_MQTT, ndpi_struct, NDPI_LOG_DEBUG, "Mqtt dissector init...\n"); ndpi_set_bitmask_protocol_detection ("MQTT", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MQTT, ndpi_search_mqtt, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id +=1; } #endif // NDPI_PROTOCOL_MQTT nDPI-2.2/src/lib/protocols/msn.c000066400000000000000000000541201321103654100164670ustar00rootroot00000000000000/* * msn.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_MSN #define MAX_PACKETS_FOR_MSN 100 static void ndpi_int_msn_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MSN, NDPI_PROTOCOL_UNKNOWN); } static u_int8_t ndpi_int_find_xmsn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->parsed_lines > 3) { u_int16_t i; for(i = 2; i < packet->parsed_lines; i++) { if(packet->line[i].ptr != NULL && packet->line[i].len > NDPI_STATICSTRING_LEN("X-MSN") && memcmp(packet->line[i].ptr, "X-MSN", NDPI_STATICSTRING_LEN("X-MSN")) == 0) { return 1; } } } return 0; } /* search over TCP */ static void ndpi_search_msn_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; u_int16_t plen; u_int16_t status = 0; NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp detection...\n"); #ifdef NDPI_PROTOCOL_SSL if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "msn ssl ft test\n"); if(flow->packet_counter < 10) { if(flow->packet_counter == 7 && packet->payload_packet_len > 300) { if(memcmp(packet->payload + 24, "MSNSLP", 6) == 0 || (get_u_int32_t(packet->payload, 0) == htonl(0x30000000) && get_u_int32_t(packet->payload, 4) == 0x00000000)) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "detected MSN File Transfer, ifdef ssl.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } if(flow->packet_counter >= 5 && flow->packet_counter <= 10 && (get_u_int32_t(packet->payload, 0) == htonl(0x18000000) && get_u_int32_t(packet->payload, 4) == 0x00000000)) { flow->l4.tcp.msn_ssl_ft++; NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "increased msn ft ssl stage to: %u at packet nr: %u\n", flow->l4.tcp.msn_ssl_ft, flow->packet_counter); if (flow->l4.tcp.msn_ssl_ft == 2) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "detected MSN File Transfer, ifdef ssl 2.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); } return; } } } #endif /* we detect the initial connection only ! */ /* match: "VER " ..... "CVR" x 0x0d 0x0a * len should be small, lets say less than 100 bytes * x is now "0", but can be increased */ /* now we have a look at the first packet only. */ if(flow->packet_counter == 1 #ifdef NDPI_PROTOCOL_SSL || ((packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) && flow->packet_counter <= 3) #endif ) { /* this part is working asymmetrically */ if(packet->payload_packet_len > 32 && (packet->payload[0] == 0x02 || packet->payload[0] == 0x00) && (ntohl(get_u_int32_t(packet->payload, 8)) == 0x2112a442 || ntohl(get_u_int32_t(packet->payload, 4)) == 0x2112a442) && ((ntohl(get_u_int32_t(packet->payload, 24)) == 0x000f0004 && ntohl(get_u_int32_t(packet->payload, 28)) == 0x72c64bc6) || (ntohl(get_u_int32_t(packet->payload, 20)) == 0x000f0004 && ntohl(get_u_int32_t(packet->payload, 24)) == 0x72c64bc6))) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN in packets that also contain voice.messenger.live.com.\n"); /* TODO this is an alternative pattern for video detection */ /* if (packet->payload_packet_len > 100 && get_u_int16_t(packet->payload, 86) == htons(0x05dc)) { */ if(packet->payload_packet_len > 101 && packet->payload[101] == 0x02) { ndpi_int_msn_add_connection(ndpi_struct, flow); } else { ndpi_int_msn_add_connection(ndpi_struct, flow); } return; } /* this case works asymmetrically */ if (packet->payload_packet_len > 10 && packet->payload_packet_len < 100) { if (get_u_int8_t(packet->payload, packet->payload_packet_len - 2) == 0x0d && get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x0a) { /* The MSNP string is used in XBOX clients. */ if (ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "VER ")) { if (memcmp(&packet->payload[packet->payload_packet_len - 6], "CVR", 3) == 0 || memcmp(&packet->payload[packet->payload_packet_len - 8], "MSNP", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN by pattern VER...CVR/MSNP ODOA.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } if (ndpi_match_strprefix(&packet->payload[4], packet->payload_packet_len-4, "MSNFT")) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN FT by pattern VER MSNFT...0d0a.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } } } if( #ifdef NDPI_PROTOCOL_HTTP packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP || #endif ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "GET ") || ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "POST ")) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->user_agent_line.ptr != NULL && packet->user_agent_line.len > NDPI_STATICSTRING_LEN("Messenger/") && memcmp(packet->user_agent_line.ptr, "Messenger/", NDPI_STATICSTRING_LEN("Messenger/")) == 0) { ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } /* #ifdef NDPI_PROTOCOL_HTTP */ /* /\* we have to examine two http packets *\/ */ /* if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) { */ /* } */ /* #endif */ /* not seen this pattern in any trace */ /* now test for http login, at least 100 a bytes packet */ if(packet->payload_packet_len > 100) { if( #ifdef NDPI_PROTOCOL_HTTP packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP || #endif memcmp(packet->payload, "POST http://", 12) == 0) { /* scan packet if not already done... */ ndpi_parse_packet_line_info(ndpi_struct, flow); if(packet->content_line.ptr != NULL && ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") && memcmp(packet->content_line.ptr, "application/x-msn-messenger", NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) || (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") && memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN by pattern POST http:// .... application/x-msn-messenger.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } } /* now test for http login that uses a gateway, at least 400 a bytes packet */ /* for this case the asymmetric detection is asym (1) */ if(packet->payload_packet_len > 400) { if(( #ifdef NDPI_PROTOCOL_HTTP packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP || #endif (memcmp(packet->payload, "POST ", 5) == 0))) { u_int16_t c; if(memcmp(&packet->payload[5], "http://", 7) == 0) { /* * We are searching for a pattern "POST http://gateway.messenger.hotmail.com/gateway/gateway.dll" or * "POST http:///gateway/gateway.dll" * POST http:// is 12 byte so we are searching for 13 to 70 byte for this paten. */ for(c = 13; c < 50; c++) { if(memcmp(&packet->payload[c], "/", 1) == 0) { if(memcmp(&packet->payload[c], "/gateway/gateway.dll", 20) == 0) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found pattern http://.../gateway/gateway.ddl.\n"); status = 1; break; } } } } else if((memcmp(&packet->payload[5], "/gateway/gateway.dll", 20) == 0)) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found pattern http://.../gateway/gateway.ddl.\n"); status = 1; } } if(status) { u_int16_t a; ndpi_parse_packet_line_info(ndpi_struct, flow); if(packet->content_line.ptr != NULL && ((packet->content_line.len == 23 && memcmp(packet->content_line.ptr, "text/xml; charset=utf-8", 23) == 0) || (packet->content_line.len == 24 && memcmp(packet->content_line.ptr, "text/html; charset=utf-8", 24) == 0) || (packet->content_line.len == 33 && memcmp(packet->content_line.ptr, "application/x-www-form-urlencoded", 33) == 0))) { if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0) || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern text/xml; charset=utf-8.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } for(a = 0; a < packet->parsed_lines; a++) { if(packet->line[a].len >= 4 && (memcmp(packet->line[a].ptr, "CVR ", 4) == 0 || memcmp(packet->line[a].ptr, "VER ", 4) == 0 || memcmp(packet->line[a].ptr, "ANS ", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern text/sml; charset0utf-8.\n"); NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN xml CVS / VER / ANS found\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } } } } /* asym (1) ; possibly occurs in symmetric cases also. */ if(flow->packet_counter <= 10 && (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2) && packet->payload_packet_len > 100) { /* not necessary to check the length, because this has been done : >400. */ if( #ifdef NDPI_PROTOCOL_HTTP packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP || #endif ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.0 200 OK") || ndpi_match_strprefix(packet->payload, packet->payload_packet_len, "HTTP/1.1 200 OK") ) { ndpi_parse_packet_line_info(ndpi_struct, flow); if(packet->content_line.ptr != NULL && ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") && memcmp(packet->content_line.ptr, "application/x-msn-messenger", NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) || (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") && memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... application/x-msn-messenger.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } } /* did not find any trace with this pattern */ /* now block proxy connection */ if(packet->payload_packet_len >= 42) { if(memcmp(packet->payload, "CONNECT messenger.hotmail.com:1863 HTTP/1.", 42) == 0) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern CONNECT messenger.hotmail.com:1863 HTTP/1..\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } if (packet->payload_packet_len >= 18) { if (memcmp(packet->payload, "USR ", 4) == 0 || memcmp(packet->payload, "ANS ", 4) == 0) { /* now we must see a number */ const u_int16_t endlen = packet->payload_packet_len - 12; plen = 4; while (1) { if (packet->payload[plen] == ' ') { break; } if (packet->payload[plen] < '0' || packet->payload[plen] > '9') { goto ndpi_msn_exclude; } plen++; if (plen >= endlen) { goto ndpi_msn_exclude; } } while (plen < endlen) { if (ndpi_check_for_email_address(ndpi_struct, flow, plen) != 0) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found mail address\n"); break; } if (packet->payload_packet_len > plen + 1 && (packet->payload[plen] < 20 || packet->payload[plen] > 128)) { goto ndpi_msn_exclude; } plen++; if (plen >= endlen) { goto ndpi_msn_exclude; } } NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "found MSN with pattern USR/ANS ...mail_address.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } } /* finished examining the first packet only. */ /* asym (1) ; possibly occurs in symmetric cases also. */ if(flow->packet_counter <= 10 && (flow->packet_direction_counter[0] <= 2 || flow->packet_direction_counter[1] <= 2) && packet->payload_packet_len > 100) { /* not necessary to check the length, because this has been done : >400. */ if( #ifdef NDPI_PROTOCOL_HTTP packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP || #endif (memcmp(packet->payload, "HTTP/1.0 200 OK", 15) == 0) || (memcmp(packet->payload, "HTTP/1.1 200 OK", 15) == 0)) { ndpi_parse_packet_line_info(ndpi_struct, flow); if(packet->content_line.ptr != NULL && ((packet->content_line.len == NDPI_STATICSTRING_LEN("application/x-msn-messenger") && memcmp(packet->content_line.ptr, "application/x-msn-messenger", NDPI_STATICSTRING_LEN("application/x-msn-messenger")) == 0) || (packet->content_line.len >= NDPI_STATICSTRING_LEN("text/x-msnmsgr") && memcmp(packet->content_line.ptr, "text/x-msnmsgr", NDPI_STATICSTRING_LEN("text/x-msnmsgr")) == 0))) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... application/x-msn-messenger.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } if(ndpi_int_find_xmsn(ndpi_struct, flow) == 1) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "HTTP/1.0 200 OK .... X-MSN.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } } /* finished examining the second packet only */ /* direct user connection (file transfer,...) */ if((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0) || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) != 0)) { if (flow->packet_counter == 1 && packet->payload_packet_len > 12 && memcmp(packet->payload, "recipientid=", 12) == 0) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "detected file transfer.\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); return; } } /* MSN File Transfer of MSN 8.1 and 8.5 * first packet with length 4 and pattern 0x04000000 * second packet (in the same direction), with length 56 and pattern 0x00000000 from payload[16] * third packet (in the opposite direction to 1 & 2), with length 4 and pattern 0x30000000 */ if(flow->l4.tcp.msn_stage == 0) { /* asymmetric detection to this pattern is asym (2) */ if((packet->payload_packet_len == 4 || packet->payload_packet_len == 8) && get_u_int32_t(packet->payload, 0) == htonl(0x04000000)) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "maybe first TCP MSN detected\n"); if(packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 4) == htonl(0x666f6f00)) { flow->l4.tcp.msn_stage = 5 + packet->packet_direction; return; } flow->l4.tcp.msn_stage = 1 + packet->packet_direction; return; } /* asymmetric detection to this pattern is asym (2) */ } else if (flow->l4.tcp.msn_stage == 1 + packet->packet_direction) { if (packet->payload_packet_len > 10 && get_u_int32_t(packet->payload, 0) == htonl(0x666f6f00)) { ndpi_int_msn_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 1\n"); return; } /* did not see this pattern in any trace */ if (packet->payload_packet_len == 56 && get_u_int32_t(packet->payload, 16) == 0) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "maybe Second TCP MSN detected\n"); flow->l4.tcp.msn_stage = 3 + packet->packet_direction; return; } } else if (flow->l4.tcp.msn_stage == 2 - packet->packet_direction && packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x30000000)) { ndpi_int_msn_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 2\n"); return; } else if ((flow->l4.tcp.msn_stage == 3 + packet->packet_direction) || (flow->l4.tcp.msn_stage == 4 - packet->packet_direction)) { if (packet->payload_packet_len == 4 && get_u_int32_t(packet->payload, 0) == htonl(0x30000000)) { ndpi_int_msn_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 2\n"); return; } } else if (flow->l4.tcp.msn_stage == 6 - packet->packet_direction) { if ((packet->payload_packet_len == 4) && (get_u_int32_t(packet->payload, 0) == htonl(0x10000000) || get_u_int32_t(packet->payload, 0) == htonl(0x30000000))) { ndpi_int_msn_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 3\n"); return; } } else if (flow->l4.tcp.msn_stage == 5 + packet->packet_direction) { if ((packet->payload_packet_len == 20) && get_u_int32_t(packet->payload, 0) == htonl(0x10000000)) { ndpi_int_msn_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN File Transfer detected 3\n"); return; } } NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_DEBUG, "msn 7.\n"); if (flow->packet_counter <= MAX_PACKETS_FOR_MSN) { if (memcmp(&packet->payload[0], "MSG ", 4) == 0 || memcmp(&packet->payload[0], "PNG", 3) == 0 || memcmp(&packet->payload[0], "QNG ", 4) == 0 || memcmp(&packet->payload[0], "OUT", 3) == 0 || memcmp(&packet->payload[0], "RNG ", 4) == 0 || memcmp(&packet->payload[0], "NLN ", 4) == 0 || memcmp(&packet->payload[0], "UBX ", 4) == 0 || memcmp(&packet->payload[0], "XFR ", 4) == 0) { ndpi_int_msn_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN detected\n"); return; } } NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "MSN tcp excluded.\n"); ndpi_msn_exclude: NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN); } /* search over UDP */ static void ndpi_search_msn_udp_misc(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; /* do we have an msn login ? */ if ((src == NULL || NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) && (dst == NULL || NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0)) { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN); return; } /* asymmetric ft detection works */ if (packet->payload_packet_len == 20 && get_u_int32_t(packet->payload, 4) == 0 && packet->payload[9] == 0 && get_u_int16_t(packet->payload, 10) == htons(0x0100)) { NDPI_LOG(NDPI_PROTOCOL_MSN, ndpi_struct, NDPI_LOG_TRACE, "msn udp misc data connection detected\n"); ndpi_int_msn_add_connection(ndpi_struct, flow); } /* asymmetric detection working. */ return; //} } void ndpi_search_msn(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* this if request should always be true */ if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSN) == 0) { /* we deal with tcp now */ if(packet->tcp != NULL) { /* msn can use http or ssl for connection. That's why every http, ssl and ukn packet must enter in the msn detection */ /* the detection can switch out the http or the ssl detection. In this case we need not check those protocols */ // need to do the ceck when protocol == http too (POST /gateway ...) if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN #ifdef NDPI_PROTOCOL_HTTP || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP #endif #ifdef NDPI_PROTOCOL_SSL || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL #endif #ifdef NDPI_PROTOCOL_STUN || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN #endif ) ndpi_search_msn_tcp(ndpi_struct, flow); } else if (packet->udp != NULL) { ndpi_search_msn_udp_misc(ndpi_struct, flow); } } } void init_msn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { NDPI_BITMASK_RESET(ndpi_struct->callback_buffer[*id].excluded_protocol_bitmask); ndpi_set_bitmask_protocol_detection("MSN", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MSN, ndpi_search_msn, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mssql_tds.c000066400000000000000000000056071321103654100177110ustar00rootroot00000000000000/* * mssql.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MSSQL_TDS struct tds_packet_header { u_int8_t type; u_int8_t status; u_int16_t length; u_int16_t channel; u_int8_t number; u_int8_t window; }; static void ndpi_int_mssql_tds_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MSSQL_TDS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_mssql_tds(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct tds_packet_header *h = (struct tds_packet_header*) packet->payload; if(packet->payload_packet_len < sizeof(struct tds_packet_header)) { NDPI_LOG(NDPI_PROTOCOL_MSSQL_TDS, ndpi_struct, NDPI_LOG_DEBUG, "exclude mssql_tds\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSSQL_TDS); return; } if((h->type >= 1 && h->type <= 8) || (h->type >= 14 && h->type <= 18)) { if(h->status == 0x00 || h->status == 0x01 || h->status == 0x02 || h->status == 0x04 || h->status == 0x08 || h->status == 0x09 || h->status == 0x10) { if(ntohs(h->length) == packet->payload_packet_len && h->window == 0x00) { NDPI_LOG(NDPI_PROTOCOL_MSSQL_TDS, ndpi_struct, NDPI_LOG_DEBUG, "found mssql_tds\n"); ndpi_int_mssql_tds_add_connection(ndpi_struct, flow); return; } } } NDPI_LOG(NDPI_PROTOCOL_MSSQL_TDS, ndpi_struct, NDPI_LOG_DEBUG, "exclude mssql_tds\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MSSQL_TDS); } void init_mssql_tds_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MsSQL_TDS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MSSQL_TDS, ndpi_search_mssql_tds, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/mysql.c000066400000000000000000000060711321103654100170410ustar00rootroot00000000000000/* * mysql.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_MYSQL static void ndpi_int_mysql_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MYSQL, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_mysql_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if(packet->tcp) { if (packet->payload_packet_len > 38 //min length && get_u_int16_t(packet->payload, 0) == packet->payload_packet_len - 4 //first 3 bytes are length && get_u_int8_t(packet->payload, 2) == 0x00 //3rd byte of packet length && get_u_int8_t(packet->payload, 3) == 0x00 //packet sequence number is 0 for startup packet && get_u_int8_t(packet->payload, 5) > 0x30 //server version > 0 && get_u_int8_t(packet->payload, 5) < 0x37 //server version < 7 && get_u_int8_t(packet->payload, 6) == 0x2e //dot ) { u_int32_t a; for (a = 7; a + 31 < packet->payload_packet_len; a++) { if (packet->payload[a] == 0x00) { if (get_u_int8_t(packet->payload, a + 13) == 0x00 //filler byte && get_u_int64_t(packet->payload, a + 19) == 0x0ULL //13 more && get_u_int32_t(packet->payload, a + 27) == 0x0 //filler bytes && get_u_int8_t(packet->payload, a + 31) == 0x0) { NDPI_LOG(NDPI_PROTOCOL_MYSQL, ndpi_struct, NDPI_LOG_DEBUG, "MySQL detected.\n"); ndpi_int_mysql_add_connection(ndpi_struct, flow); return; } break; } } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_MYSQL); } void init_mysql_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("MySQL", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_MYSQL, ndpi_search_mysql_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/netbios.c000066400000000000000000000324171321103654100173420ustar00rootroot00000000000000/* * netbios.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-17 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_NETBIOS struct netbios_header { u_int16_t transaction_id, flags, questions, answer_rrs, authority_rrs, additional_rrs; }; /* The function below has been inherited by tcpdump */ int ndpi_netbios_name_interpret(char *in, char *out, u_int out_len) { int ret = 0, len; char *b; len = (*in++)/2; b = out; *out=0; if(len > (out_len-1) || len < 1) return(-1); while (len--) { if(in[0] < 'A' || in[0] > 'P' || in[1] < 'A' || in[1] > 'P') { *out = 0; break; } *out = ((in[0]-'A')<<4) + (in[1]-'A'); in += 2; if(isprint(*out)) out++, ret++; } *out = 0; /* Courtesy of Roberto F. De Luca */ /* Trim trailing whitespace from the returned string */ for(out--; out>=b && *out==' '; out--) *out = '\0'; return(ret); } static void ndpi_int_netbios_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NETBIOS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_netbios(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport; char name[64]; if(packet->udp != NULL) { dport = ntohs(packet->udp->dest); NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "netbios udp start\n"); /*check standard NETBIOS over udp to port 137 */ if((dport == 137 || 0) && packet->payload_packet_len >= 50) { struct netbios_header h; memcpy(&h, packet->payload, sizeof(struct netbios_header)); h.transaction_id = ntohs(h.transaction_id), h.flags = ntohs(h.flags), h.questions = ntohs(h.questions), h.answer_rrs = ntohs(h.answer_rrs), h.authority_rrs = ntohs(h.authority_rrs), h.additional_rrs = ntohs(h.additional_rrs); NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios port 137 and payload_packet_len 50\n"); if(h.flags == 0 && h.questions == 1 && h.answer_rrs == 0 && h.authority_rrs == 0 && h.additional_rrs == 0) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with questions = 1 and answers = 0, authority = 0 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(((h.flags & 0x8710) == 0x10) && h.questions == 1 && h.answer_rrs == 0 && h.authority_rrs == 0) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with questions = 1 and answers = 0, authority = 0 and broadcast \n"); if(ndpi_netbios_name_interpret((char*)&packet->payload[12], name, sizeof(name)) > 0) snprintf((char*)flow->host_server_name, sizeof(flow->host_server_name)-1, "%s", name); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(packet->payload[2] == 0x80 && h.questions == 1 && h.answer_rrs == 0 && h.authority_rrs == 0 && h.additional_rrs == 1) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with questions = 1 and answers, authority, additional = 0 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(h.flags == 0x4000 && h.questions == 1 && h.answer_rrs == 0 && h.authority_rrs == 0 && h.additional_rrs == 1) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with questions = 1 and answers = 0, authority = 0 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(h.flags == 0x8400 && h.questions == 0 && h.answer_rrs == 1 && h.authority_rrs == 0 && h.additional_rrs == 0) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with flag 8400 questions = 0 and answers = 1, authority, additional = 0 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(h.flags == 0x8500 && h.questions == 0 && h.answer_rrs == 1 && h.authority_rrs == 0 && h.additional_rrs == 0) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with flag 8500 questions = 0 and answers = 1, authority, additional = 0 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(h.flags == 0x2910 && h.questions == 1 && h.answer_rrs == 0 && h.authority_rrs == 0 && h.additional_rrs == 1) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with flag 2910, questions = 1 and answers, authority=0, additional = 1 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(h.flags == 0xAD86 && h.questions == 0 && h.answer_rrs == 1 && h.authority_rrs == 0 && h.additional_rrs == 0) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with flag ad86 questions = 0 and answers = 1, authority, additional = 0 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if(h.flags == 0x0110 && h.questions == 1 && h.answer_rrs == 0 && h.authority_rrs == 0 && h.additional_rrs == 0) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with flag 0110 questions = 1 and answers = 0, authority, additional = 0 \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } if((h.flags & 0xf800) == 0) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios name query request\n"); if(get_u_int16_t(packet->payload, 4) == htons(1) && get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == 0 && get_u_int16_t(packet->payload, 10) == 0) { /* name is encoded as described in rfc883 */ u_int8_t name_length = packet->payload[12]; NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios name query request, one question\n"); if(packet->payload_packet_len == 12 + 1 + name_length + 1 + 2 + 2) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios name query request, length matches\n"); /* null terminated? */ if(packet->payload[12 + name_length + 1] == 0 && get_u_int16_t(packet->payload, 12 + name_length + 2) == htons(0x0020) && get_u_int16_t(packet->payload, 12 + name_length + 4) == htons(0x0001)) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios name query request\n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } } } } else if((h.flags & 0xf800) == 0x8000) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios name query response\n"); if(get_u_int16_t(packet->payload, 4) == 0 && get_u_int16_t(packet->payload, 6) == htons(1) && get_u_int16_t(packet->payload, 8) == 0 && get_u_int16_t(packet->payload, 10) == 0) { /* name is encoded as described in rfc883 */ u_int8_t name_length = packet->payload[12]; NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios positive name query response, one answer\n"); if(packet->payload_packet_len >= 12 + 1 + name_length + 1 + 2 + 2) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios name query response, length matches\n"); /* null terminated? */ if(packet->payload[12 + name_length + 1] == 0 && get_u_int16_t(packet->payload, 12 + name_length + 2) == htons(0x0020) && get_u_int16_t(packet->payload, 12 + name_length + 4) == htons(0x0001)) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios name query response\n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } } } else if(get_u_int16_t(packet->payload, 4) == 0 && get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == 0 && get_u_int16_t(packet->payload, 10) == 0) { /* name is encoded as described in rfc883 */ u_int8_t name_length = packet->payload[12]; NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios negative name query response, one answer\n"); if(packet->payload_packet_len >= 12 + 1 + name_length + 1 + 2 + 2) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios name query response, length matches\n"); /* null terminated? */ if(packet->payload[12 + name_length + 1] == 0 && get_u_int16_t(packet->payload, 12 + name_length + 2) == htons(0x000A) && get_u_int16_t(packet->payload, 12 + name_length + 4) == htons(0x0001)) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios name query response\n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } } } else if(get_u_int16_t(packet->payload, 4) == 0 && get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == htons(1) && get_u_int16_t(packet->payload, 10) == htons(1)) { /* name is encoded as described in rfc883 */ u_int8_t name_length = packet->payload[12]; NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios redirect name query response, one answer\n"); if(packet->payload_packet_len >= 12 + 1 + name_length + 1 + 2 + 2) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "possible netbios name query response, length matches\n"); /* null terminated? */ if(packet->payload[12 + name_length + 1] == 0 && get_u_int16_t(packet->payload, 12 + name_length + 2) == htons(0x0002) && get_u_int16_t(packet->payload, 12 + name_length + 4) == htons(0x0001)) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios name query response\n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } } } } /* TODO: extend according to rfc1002 */ } /*check standard NETBIOS over udp to port 138 */ /*netbios header token from http://www.protocolbase.net/protocols/protocol_NBDGM.php */ if((dport == 138) && packet->payload_packet_len >= 14 && ntohs(get_u_int16_t(packet->payload, 10)) == packet->payload_packet_len - 14) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios port 138 and payload length >= 112 \n"); if(packet->payload[0] >= 0x11 && packet->payload[0] <= 0x16) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with MSG-type 0x11,0x12,0x13,0x14,0x15 or 0x16\n"); if(ntohl(get_u_int32_t(packet->payload, 4)) == ntohl(packet->iph->saddr)) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with checked ip-address.\n"); if(ndpi_netbios_name_interpret((char*)&packet->payload[12], name, sizeof(name)) > 0) snprintf((char*)flow->host_server_name, sizeof(flow->host_server_name)-1, "%s", name); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } } } } if(packet->tcp != NULL) { dport = ntohs(packet->tcp->dest); NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "netbios tcp start\n"); /* destination port must be 139 */ if(dport == 139) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with destination port 139\n"); /* payload_packet_len must be 72 */ if(packet->payload_packet_len == 72) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with payload_packen_len = 72. \n"); if(packet->payload[0] == 0x81 && packet->payload[1] == 0 && ntohs(get_u_int16_t(packet->payload, 2)) == 68) { NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "found netbios with session request = 81, flags=0 and length od following bytes = 68. \n"); ndpi_int_netbios_add_connection(ndpi_struct, flow); return; } } } } NDPI_LOG(NDPI_PROTOCOL_NETBIOS, ndpi_struct, NDPI_LOG_DEBUG, "exclude netbios\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_NETBIOS); } void init_netbios_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("NETBIOS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_NETBIOS, ndpi_search_netbios, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/netflow.c000066400000000000000000000157521321103654100173600ustar00rootroot00000000000000/* * netflow.c * * Copyright (C) 2011-15 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_NETFLOW #ifdef WIN32 extern int gettimeofday(struct timeval * tp, struct timezone * tzp); #endif #define do_gettimeofday(a) gettimeofday(a, NULL) struct flow_ver1_rec { u_int32_t srcaddr; /* Source IP Address */ u_int32_t dstaddr; /* Destination IP Address */ u_int32_t nexthop; /* Next hop router's IP Address */ u_int16_t input; /* Input interface index */ u_int16_t output; /* Output interface index */ u_int32_t dPkts; /* Packets sent in Duration */ u_int32_t dOctets; /* Octets sent in Duration */ u_int32_t first; /* SysUptime at start of flow */ u_int32_t last; /* and of last packet of the flow */ u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */ u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */ u_int16_t pad; /* pad to word boundary */ u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */ u_int8_t tos; /* IP Type-of-Service */ u_int8_t pad2[7]; /* pad to word boundary */ }; struct flow_ver5_rec { u_int32_t srcaddr; /* Source IP Address */ u_int32_t dstaddr; /* Destination IP Address */ u_int32_t nexthop; /* Next hop router's IP Address */ u_int16_t input; /* Input interface index */ u_int16_t output; /* Output interface index */ u_int32_t dPkts; /* Packets sent in Duration (milliseconds between 1st & last packet in this flow)*/ u_int32_t dOctets; /* Octets sent in Duration (milliseconds between 1st & last packet in this flow)*/ u_int32_t first; /* SysUptime at start of flow */ u_int32_t last; /* and of last packet of the flow */ u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */ u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */ u_int8_t pad1; /* pad to word boundary */ u_int8_t tcp_flags; /* Cumulative OR of tcp flags */ u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */ u_int8_t tos; /* IP Type-of-Service */ u_int16_t src_as; /* source peer/origin Autonomous System */ u_int16_t dst_as; /* dst peer/origin Autonomous System */ u_int8_t src_mask; /* source route's mask bits */ u_int8_t dst_mask; /* destination route's mask bits */ u_int16_t pad2; /* pad to word boundary */ }; struct flow_ver7_rec { u_int32_t srcaddr; /* Source IP Address */ u_int32_t dstaddr; /* Destination IP Address */ u_int32_t nexthop; /* Next hop router's IP Address */ u_int16_t input; /* Input interface index */ u_int16_t output; /* Output interface index */ u_int32_t dPkts; /* Packets sent in Duration */ u_int32_t dOctets; /* Octets sent in Duration */ u_int32_t first; /* SysUptime at start of flow */ u_int32_t last; /* and of last packet of the flow */ u_int16_t srcport; /* TCP/UDP source port number (.e.g, FTP, Telnet, etc.,or equivalent) */ u_int16_t dstport; /* TCP/UDP destination port number (.e.g, FTP, Telnet, etc.,or equivalent) */ u_int8_t flags; /* Shortcut mode(dest only,src only,full flows*/ u_int8_t tcp_flags; /* Cumulative OR of tcp flags */ u_int8_t proto; /* IP protocol, e.g., 6=TCP, 17=UDP, etc... */ u_int8_t tos; /* IP Type-of-Service */ u_int16_t dst_as; /* dst peer/origin Autonomous System */ u_int16_t src_as; /* source peer/origin Autonomous System */ u_int8_t dst_mask; /* destination route's mask bits */ u_int8_t src_mask; /* source route's mask bits */ u_int16_t pad2; /* pad to word boundary */ u_int32_t router_sc; /* Router which is shortcut by switch */ }; static void ndpi_check_netflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; time_t now; struct timeval now_tv; if((packet->udp != NULL) && (payload_len >= 24)) { u_int16_t version = (packet->payload[0] << 8) + packet->payload[1], uptime_offset; u_int32_t when, *_when; u_int16_t n = (packet->payload[2] << 8) + packet->payload[3], expected_len = 0; switch(version) { case 1: case 5: case 7: case 9: if((n == 0) || (n > 30)) return; switch(version) { case 1: expected_len = n * sizeof(struct flow_ver1_rec) + 16 /* header */; break; case 5: expected_len = n * sizeof(struct flow_ver5_rec) + 24 /* header */; break; case 7: expected_len = n * sizeof(struct flow_ver7_rec) + 24 /* header */; break; case 9: /* We need to check the template */ break; } if((expected_len > 0) && (expected_len != payload_len)) { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_NETFLOW); return; } uptime_offset = 8; break; case 10: /* IPFIX */ { u_int16_t ipfix_len = n; if(ipfix_len != payload_len) return; } uptime_offset = 4; break; default: return; } _when = (u_int32_t*)&packet->payload[uptime_offset]; /* Sysuptime */ when = ntohl(*_when); do_gettimeofday(&now_tv); now = now_tv.tv_sec; if(((version == 1) && (when == 0)) || ((when >= 946684800 /* 1/1/2000 */) && (when <= now))) { NDPI_LOG(NDPI_PROTOCOL_NETFLOW, ndpi_struct, NDPI_LOG_DEBUG, "Found netflow.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NETFLOW, NDPI_PROTOCOL_UNKNOWN); return; } } } void ndpi_search_netflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { NDPI_LOG(NDPI_PROTOCOL_NETFLOW, ndpi_struct, NDPI_LOG_DEBUG, "netflow detection...\n"); ndpi_check_netflow(ndpi_struct, flow); } void init_netflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("NetFlow", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_NETFLOW, ndpi_search_netflow, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/nfs.c000066400000000000000000000063711321103654100164650ustar00rootroot00000000000000/* * nfs.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_NFS static void ndpi_int_nfs_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NFS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_nfs(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int8_t offset = 0; if (packet->tcp != NULL) offset = 4; if (packet->payload_packet_len < (40 + offset)) goto exclude_nfs; NDPI_LOG(NDPI_PROTOCOL_NFS, ndpi_struct, NDPI_LOG_DEBUG, "NFS user match stage 1\n"); if (offset != 0 && get_u_int32_t(packet->payload, 0) != htonl(0x80000000 + packet->payload_packet_len - 4)) goto exclude_nfs; NDPI_LOG(NDPI_PROTOCOL_NFS, ndpi_struct, NDPI_LOG_DEBUG, "NFS user match stage 2\n"); if (get_u_int32_t(packet->payload, 4 + offset) != 0) goto exclude_nfs; NDPI_LOG(NDPI_PROTOCOL_NFS, ndpi_struct, NDPI_LOG_DEBUG, "NFS user match stage 3\n"); if (get_u_int32_t(packet->payload, 8 + offset) != htonl(0x02)) goto exclude_nfs; NDPI_LOG(NDPI_PROTOCOL_NFS, ndpi_struct, NDPI_LOG_DEBUG, "NFS match stage 3\n"); if (get_u_int32_t(packet->payload, 12 + offset) != htonl(0x000186a5) && get_u_int32_t(packet->payload, 12 + offset) != htonl(0x000186a3) && get_u_int32_t(packet->payload, 12 + offset) != htonl(0x000186a0)) goto exclude_nfs; NDPI_LOG(NDPI_PROTOCOL_NFS, ndpi_struct, NDPI_LOG_DEBUG, "NFS match stage 4\n"); if (ntohl(get_u_int32_t(packet->payload, 16 + offset)) > 4) goto exclude_nfs; NDPI_LOG(NDPI_PROTOCOL_NFS, ndpi_struct, NDPI_LOG_DEBUG, "NFS match\n"); ndpi_int_nfs_add_connection(ndpi_struct, flow); return; exclude_nfs: NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_NFS); } void init_nfs_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("NFS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_NFS, ndpi_search_nfs, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/nintendo.c000066400000000000000000000046211321103654100175110ustar00rootroot00000000000000/* * nintendo.c * * Copyright (C) 2017 by ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_NINTENDO static void ndpi_int_nintendo_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t due_to_correlation) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NINTENDO, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_nintendo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { if(payload_len > 48) { const char *payload = (const char *)packet->payload; const char nintendo_pattern[] = { 0x32, 0xab, 0x98, 0x64, 0x02 }; if(memcmp(payload, nintendo_pattern, 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_NINTENDO, ndpi_struct, NDPI_LOG_DEBUG, "Found nintendo.\n"); ndpi_int_nintendo_add_connection(ndpi_struct, flow, 0); return; } } } NDPI_LOG(NDPI_PROTOCOL_NINTENDO, ndpi_struct, NDPI_LOG_DEBUG, "Exclude Nintendo.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_NINTENDO); } void init_nintendo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Nintendo", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_NINTENDO, ndpi_search_nintendo, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/noe.c000066400000000000000000000044761321103654100164640ustar00rootroot00000000000000/* * noe.c (Alcatel new office environment) * * Copyright (C) 2013 Remy Mudingay * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_NOE static void ndpi_int_noe_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NOE, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_noe(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_NOE, ndpi_struct, NDPI_LOG_DEBUG, "search for NOE.\n"); if(packet->udp != NULL) { NDPI_LOG(NDPI_PROTOCOL_NOE, ndpi_struct, NDPI_LOG_DEBUG, "calculating dport over udp.\n"); if (packet->payload_packet_len == 1 && ( packet->payload[0] == 0x05 || packet->payload[0] == 0x04 )) { NDPI_LOG(NDPI_PROTOCOL_NOE, ndpi_struct, NDPI_LOG_DEBUG, "found noe.\n"); ndpi_int_noe_add_connection(ndpi_struct, flow); return; } else if((packet->payload_packet_len == 5 || packet->payload_packet_len == 12) && (packet->payload[0] == 0x07 ) && (packet->payload[1] == 0x00 ) && (packet->payload[2] != 0x00 ) && (packet->payload[3] == 0x00 )) { NDPI_LOG(NDPI_PROTOCOL_NOE, ndpi_struct, NDPI_LOG_DEBUG, "found noe.\n"); ndpi_int_noe_add_connection(ndpi_struct, flow); } else if((packet->payload_packet_len >= 25) && (packet->payload[0] == 0x00 && packet->payload[1] == 0x06 && packet->payload[2] == 0x62 && packet->payload[3] == 0x6c)) { NDPI_LOG(NDPI_PROTOCOL_NOE, ndpi_struct, NDPI_LOG_DEBUG, "found noe.\n"); ndpi_int_noe_add_connection(ndpi_struct, flow); } } else { NDPI_LOG(NDPI_PROTOCOL_NOE, ndpi_struct, NDPI_LOG_DEBUG, "exclude NOE.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_NOE); } } void init_noe_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("NOE", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_NOE, ndpi_search_noe, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/non_tcp_udp.c000066400000000000000000000154101321103654100202010ustar00rootroot00000000000000/* * non_tcp_udp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #if defined(NDPI_PROTOCOL_IP_IPSEC) || defined(NDPI_PROTOCOL_IP_GRE) || defined(NDPI_PROTOCOL_IP_ICMP) || defined(NDPI_PROTOCOL_IP_IGMP) || defined(NDPI_PROTOCOL_IP_EGP) || defined(NDPI_PROTOCOL_IP_SCTP) || defined(NDPI_PROTOCOL_IP_OSPF) || defined(NDPI_PROTOCOL_IP_IP_IN_IP) #define set_protocol_and_bmask(nprot) \ { \ if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask,nprot) != 0) \ { \ ndpi_set_detected_protocol(ndpi_struct, flow, \ nprot, NDPI_PROTOCOL_UNKNOWN); \ } \ } void ndpi_search_in_non_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->iph == NULL) { #ifdef NDPI_DETECTION_SUPPORT_IPV6 if (packet->iphv6 == NULL) #endif return; } switch (packet->l4_protocol) { #ifdef NDPI_PROTOCOL_IP_IPSEC case NDPI_IPSEC_PROTOCOL_ESP: case NDPI_IPSEC_PROTOCOL_AH: set_protocol_and_bmask(NDPI_PROTOCOL_IP_IPSEC); break; #endif /* NDPI_PROTOCOL_IP_IPSEC */ #ifdef NDPI_PROTOCOL_IP_GRE case NDPI_GRE_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_GRE); break; #endif /* NDPI_PROTOCOL_IP_GRE */ #ifdef NDPI_PROTOCOL_IP_ICMP case NDPI_ICMP_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_ICMP); break; #endif /* NDPI_PROTOCOL_IP_ICMP */ #ifdef NDPI_PROTOCOL_IP_IGMP case NDPI_IGMP_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_IGMP); break; #endif /* NDPI_PROTOCOL_IP_IGMP */ #ifdef NDPI_PROTOCOL_IP_EGP case NDPI_EGP_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_EGP); break; #endif /* NDPI_PROTOCOL_IP_EGP */ #ifdef NDPI_PROTOCOL_IP_SCTP case NDPI_SCTP_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_SCTP); break; #endif /* NDPI_PROTOCOL_IP_SCTP */ #ifdef NDPI_PROTOCOL_IP_OSPF case NDPI_OSPF_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_OSPF); break; #endif /* NDPI_PROTOCOL_IP_OSPF */ #ifdef NDPI_PROTOCOL_IP_IP_IN_IP case NDPI_IPIP_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_IP_IN_IP); break; #endif /* NDPI_PROTOCOL_IP_IP_IN_IP */ #ifdef NDPI_PROTOCOL_IP_ICMPV6 case NDPI_ICMPV6_PROTOCOL_TYPE: set_protocol_and_bmask(NDPI_PROTOCOL_IP_ICMPV6); break; #endif /* NDPI_PROTOCOL_IP_ICMPV6 */ #ifdef NDPI_PROTOCOL_IP_VRRP case 112: set_protocol_and_bmask(NDPI_PROTOCOL_IP_VRRP); break; #endif /* NDPI_PROTOCOL_IP_VRRP */ } } void init_non_tcp_udp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { /* always add non tcp/udp if one protocol is compiled in */ NDPI_SAVE_AS_BITMASK(ndpi_struct->callback_buffer[*id].detection_bitmask, NDPI_PROTOCOL_UNKNOWN); #ifdef NDPI_CONTENT_IP_IPSEC ndpi_set_bitmask_protocol_detection("IP_IPSEC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_IPSEC, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_GRE ndpi_set_bitmask_protocol_detection("IP_GRE", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_GRE, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_ICMP ndpi_set_bitmask_protocol_detection("IP_ICMP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_ICMP, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_IGMP ndpi_set_bitmask_protocol_detection("IP_IGMP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_IGMP, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_EGP ndpi_set_bitmask_protocol_detection("IP_EGP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_EGP, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_SCTP ndpi_set_bitmask_protocol_detection("IP_SCTP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_SCTP, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_OSPF ndpi_set_bitmask_protocol_detection("IP_OSPF", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_OSPF, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_IP_IN_IP ndpi_set_bitmask_protocol_detection("IP_IP_IN_IP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_IP_IN_IP, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif #ifdef NDPI_CONTENT_IP_ICMPV6 ndpi_set_bitmask_protocol_detection("IP_ICMPV6", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_IP_ICMPV6, ndpi_search_in_non_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_IPV4_OR_IPV6, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; #endif } #endif nDPI-2.2/src/lib/protocols/ntp.c000066400000000000000000000051541321103654100164760ustar00rootroot00000000000000/* * ntp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_NTP static void ndpi_int_ntp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_NTP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_ntp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (!(packet->udp->dest == htons(123) || packet->udp->source == htons(123))) goto exclude_ntp; NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP port detected\n"); NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP length detected\n"); if ((((packet->payload[0] & 0x38) >> 3) <= 4)) { NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "detected NTP."); // 38 in binary representation is 00111000 flow->protos.ntp.version = (packet->payload[0] & 0x38) >> 3; if (flow->protos.ntp.version == 2) { flow->protos.ntp.request_code = packet->payload[3]; } ndpi_int_ntp_add_connection(ndpi_struct, flow); return; } exclude_ntp: NDPI_LOG(NDPI_PROTOCOL_NTP, ndpi_struct, NDPI_LOG_DEBUG, "NTP excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_NTP); } void init_ntp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("NTP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_NTP, ndpi_search_ntp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/openft.c000066400000000000000000000047701321103654100171730ustar00rootroot00000000000000/* * openft.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_OPENFT static void ndpi_int_openft_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENFT, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_openft_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len > 5 && memcmp(packet->payload, "GET /", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_OPENFT, ndpi_struct, NDPI_LOG_DEBUG, "HTTP packet detected.\n"); ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->parsed_lines >= 2 && packet->line[1].len > 13 && memcmp(packet->line[1].ptr, "X-OpenftAlias:", 14) == 0) { NDPI_LOG(NDPI_PROTOCOL_OPENFT, ndpi_struct, NDPI_LOG_DEBUG, "OpenFT detected.\n"); ndpi_int_openft_add_connection(ndpi_struct, flow); return; } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OPENFT); } void init_openft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("OpenFT", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_OPENFT, ndpi_search_openft_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/openvpn.c000066400000000000000000000106401321103654100173560ustar00rootroot00000000000000/* * openvpn.c * * Copyright (C) 2011-16 - ntop.org * * OpenVPN TCP / UDP Detection - 128/160 hmac * * Detection based upon these openvpn protocol properties: * - opcode * - packet ID * - session ID * * Two (good) packets are needed to perform detection. * - First packet from client: save session ID * - Second packet from server: report saved session ID * * TODO * - Support PSK only mode (instead of TLS) * - Support PSK + TLS mode (PSK used for early authentication) * - TLS certificate extraction * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_OPENVPN #define P_CONTROL_HARD_RESET_CLIENT_V1 (0x01 << 3) #define P_CONTROL_HARD_RESET_CLIENT_V2 (0x07 << 3) #define P_CONTROL_HARD_RESET_SERVER_V1 (0x02 << 3) #define P_CONTROL_HARD_RESET_SERVER_V2 (0x08 << 3) #define P_OPCODE_MASK 0xF8 #define P_SHA1_HMAC_SIZE 20 #define P_HMAC_128 16 // (RSA-)MD5, (RSA-)MD4, ..others #define P_HMAC_160 20 // (RSA-|DSA-)SHA(1), ..others, SHA1 is openvpn default #define P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) (9 + hmac_size) #define P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size) (P_HARD_RESET_PACKET_ID_OFFSET(hmac_size) + 8) #define P_HARD_RESET_CLIENT_MAX_COUNT 5 static #ifndef WIN32 inline #endif u_int32_t get_packet_id(const u_int8_t * payload, u_int8_t hms) { return ntohl(*(u_int32_t*)(payload + P_HARD_RESET_PACKET_ID_OFFSET(hms))); } static #ifndef WIN32 inline #endif int8_t check_pkid_and_detect_hmac_size(const u_int8_t * payload) { // try to guess if (get_packet_id(payload, P_HMAC_160) == 1) return P_HMAC_160; if (get_packet_id(payload, P_HMAC_128) == 1) return P_HMAC_128; return -1; } void ndpi_search_openvpn(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { struct ndpi_packet_struct* packet = &flow->packet; const u_int8_t * ovpn_payload = packet->payload; const u_int8_t * session_remote; u_int8_t opcode; u_int8_t alen; int8_t hmac_size; int8_t failed = 0; if (packet->payload_packet_len >= 40) { // skip openvpn TCP transport packet size if (packet->tcp != NULL) ovpn_payload += 2; opcode = ovpn_payload[0] & P_OPCODE_MASK; if (flow->ovpn_counter < P_HARD_RESET_CLIENT_MAX_COUNT && (opcode == P_CONTROL_HARD_RESET_CLIENT_V1 || opcode == P_CONTROL_HARD_RESET_CLIENT_V2)) { if (check_pkid_and_detect_hmac_size(ovpn_payload) > 0) { memcpy(flow->ovpn_session_id, ovpn_payload+1, 8); NDPI_LOG(NDPI_PROTOCOL_OPENVPN, ndpi_struct, NDPI_LOG_DEBUG, "session key: %02x%02x%02x%02x%02x%02x%02x%02x\n", flow->ovpn_session_id[0], flow->ovpn_session_id[1], flow->ovpn_session_id[2], flow->ovpn_session_id[3], flow->ovpn_session_id[4], flow->ovpn_session_id[5], flow->ovpn_session_id[6], flow->ovpn_session_id[7]); } } else if (flow->ovpn_counter >= 1 && flow->ovpn_counter <= P_HARD_RESET_CLIENT_MAX_COUNT && (opcode == P_CONTROL_HARD_RESET_SERVER_V1 || opcode == P_CONTROL_HARD_RESET_SERVER_V2)) { hmac_size = check_pkid_and_detect_hmac_size(ovpn_payload); if (hmac_size > 0) { alen = ovpn_payload[P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size)]; session_remote = ovpn_payload + P_PACKET_ID_ARRAY_LEN_OFFSET(hmac_size) + 1 + alen * 4; if (memcmp(flow->ovpn_session_id, session_remote, 8) == 0) ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OPENVPN, NDPI_PROTOCOL_UNKNOWN); else { NDPI_LOG(NDPI_PROTOCOL_OPENVPN, ndpi_struct, NDPI_LOG_DEBUG, "key mismatch: %02x%02x%02x%02x%02x%02x%02x%02x\n", session_remote[0], session_remote[1], session_remote[2], session_remote[3], session_remote[4], session_remote[5], session_remote[6], session_remote[7]); failed = 1; } } else failed = 1; } else failed = 1; flow->ovpn_counter++; if (failed) NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OPENVPN); } } void init_openvpn_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("OpenVPN", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_OPENVPN, ndpi_search_openvpn, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/oracle.c000066400000000000000000000057711321103654100171470ustar00rootroot00000000000000/* * oracle.c * * Copyright (C) 2013 Remy Mudingay * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_ORACLE static void ndpi_int_oracle_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ORACLE, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_oracle(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport = 0, sport = 0; NDPI_LOG(NDPI_PROTOCOL_ORACLE, ndpi_struct, NDPI_LOG_DEBUG, "search for ORACLE.\n"); if(packet->tcp != NULL) { sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest); NDPI_LOG(NDPI_PROTOCOL_ORACLE, ndpi_struct, NDPI_LOG_DEBUG, "calculating ORACLE over tcp.\n"); /* Oracle Database 9g,10g,11g */ if ((dport == 1521 || sport == 1521) && (((packet->payload[0] == 0x07) && (packet->payload[1] == 0xff) && (packet->payload[2] == 0x00)) || ((packet->payload_packet_len >= 232) && ((packet->payload[0] == 0x00) || (packet->payload[0] == 0x01)) && (packet->payload[1] != 0x00) && (packet->payload[2] == 0x00) && (packet->payload[3] == 0x00)))) { NDPI_LOG(NDPI_PROTOCOL_ORACLE, ndpi_struct, NDPI_LOG_DEBUG, "found oracle.\n"); ndpi_int_oracle_add_connection(ndpi_struct, flow); } else if (packet->payload_packet_len == 213 && packet->payload[0] == 0x00 && packet->payload[1] == 0xd5 && packet->payload[2] == 0x00 && packet->payload[3] == 0x00 ) { NDPI_LOG(NDPI_PROTOCOL_ORACLE, ndpi_struct, NDPI_LOG_DEBUG, "found oracle.\n"); ndpi_int_oracle_add_connection(ndpi_struct, flow); } } else { NDPI_LOG(NDPI_PROTOCOL_ORACLE, ndpi_struct, NDPI_LOG_DEBUG, "exclude ORACLE.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_ORACLE); } } void init_oracle_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Oracle", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_ORACLE, ndpi_search_oracle, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/oscar.c000066400000000000000000000630301321103654100170010ustar00rootroot00000000000000/* * oscar.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #define FLAPVERSION 0x00000001 /* Flap channels */ #define SIGNON 0x01 #define DATA 0x02 #define O_ERROR 0x03 #define SIGNOFF 0x04 #define KEEP_ALIVE 0x05 /* Signon tags */ #define SCREEN_NAME 0x0001 #define PASSWD 0x0002 #define CLIENT_NAME 0x0003 #define BOS 0x0005 #define LOGIN_COOKIE 0x0006 #define MAJOR_VERSION 0x0017 #define MINOR_VERSION 0x0018 #define POINT_VERSION 0x0019 #define BUILD_NUM 0x001a #define MULTICONN_FLAGS 0x004a #define CLIENT_LANG 0x00OF #define CLIENT_CNTRY 0x00OE #define CLIENT_RECONNECT 0x0094 /* Family */ #define GE_SE_CTL 0x0001 #define LOC_SRV 0x0002 #define BUDDY_LIST 0x0003 #define IM 0x0004 #define IS 0x0006 #define ACC_ADM 0x0007 #define POPUP 0x0008 #define PMS 0x0009 #define USS 0x000b #define CHAT_ROOM_SETUP 0x000d #define CHAT_ROOM_ACT 0x000e #define USER_SRCH 0x000f #define BUDDY_ICON_SERVER 0x0010 #define SERVER_STORED_INFO 0x0013 #define ICQ 0x0015 #define INIT_AUTH 0x0017 #define EMAIL 0x0018 #define IS_EXT 0x0085 #ifdef NDPI_PROTOCOL_OSCAR static void ndpi_int_oscar_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_OSCAR, NDPI_PROTOCOL_UNKNOWN); if (src != NULL) { src->oscar_last_safe_access_time = packet->tick_timestamp; } if (dst != NULL) { dst->oscar_last_safe_access_time = packet->tick_timestamp; } } /** Oscar connection work on FLAP protocol. FLAP is a low-level communications protocol that facilitates the development of higher-level, datagram-oriented, communications layers. It is used on the TCP connection between all clients and servers. Here is format of FLAP datagram **/ static void ndpi_search_oscar_tcp_connect(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { int excluded = 0; // u_int8_t channel; u_int16_t family; u_int16_t type; u_int16_t flag; u_int32_t req_ID; struct ndpi_packet_struct * packet = &flow->packet; struct ndpi_id_struct * src = flow->src; struct ndpi_id_struct * dst = flow->dst; /* FLAP__Header * * [ 6 byte FLAP header ] * +-----------+--------------+-------------+--------------+ * | 0x2a (1B) | Channel (1B) | SeqNum (2B) | PyldLen (2B) | * +-----------+--------------+-------------+--------------+ * * [ 4 byte of data ] * * */ if (packet->payload_packet_len >= 6 && packet->payload[0] == 0x2a) { /* FLAP__FRAME_TYPE (Channel)*/ u_int8_t channel = get_u_int8_t(packet->payload, 1); /* Initialize the FLAP connection. SIGNON -> FLAP__SIGNON_FRAME +--------------------------------------------------+ + FLAP__Header | 6 byte + + FlapVersion | 4 byte (Always 1 = 0x00000001) + + TLVs | [Class: FLAP__SIGNON_TAGS] TLVs + +--------------------------------------------------+ */ if (channel == SIGNON && get_u_int16_t(packet->payload, 4) == htons(packet->payload_packet_len - 6) && get_u_int32_t(packet->payload, 6) == htonl(FLAPVERSION)) { /* No TLVs */ if(packet->payload_packet_len == 10) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Sign In \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* /\* SCREEN_NAME *\/ */ /* if (get_u_int16_t(packet->payload, 10) == htons(SCREEN_NAME)) /\* packet->payload[10] == 0x00 && packet->payload[11] == 0x01 *\/ */ /* { */ /* NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Screen Name \n"); */ /* ndpi_int_oscar_add_connection(ndpi_struct, flow); */ /* return; */ /* } */ /* /\* PASSWD *\/ */ /* if (get_u_int16_t(packet->payload, 10) == htons(PASSWD)) /\* packet->payload[10] == 0x00 && packet->payload[11] == 0x02 *\/ */ /* { */ /* NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Password (roasted) \n"); */ /* ndpi_int_oscar_add_connection(ndpi_struct, flow); */ /* return; */ /* } */ /* CLIENT_NAME */ if (get_u_int16_t(packet->payload, 10) == htons(CLIENT_NAME)) /* packet->payload[10] == 0x00 && packet->payload[11] == 0x03 */ { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Client Name \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* LOGIN_COOKIE */ if (get_u_int16_t(packet->payload, 10) == htons(LOGIN_COOKIE) && get_u_int16_t(packet->payload, 12) == htons(0x0100)) { if(get_u_int16_t(packet->payload, packet->payload_packet_len - 5) == htons(MULTICONN_FLAGS)) /* MULTICONN_FLAGS */ { if(get_u_int16_t(packet->payload, packet->payload_packet_len - 3) == htons(0x0001)) if((get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x00) || (get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x01) || (get_u_int8_t(packet->payload, packet->payload_packet_len - 1) == 0x03)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Login \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } } /* MAJOR_VERSION */ if (get_u_int16_t(packet->payload, 10) == htons(MAJOR_VERSION)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Major_Version \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* MINOR_VERSION */ if (get_u_int16_t(packet->payload, 10) == htons(MINOR_VERSION)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Minor_Version \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* POINT_VERSION */ if (get_u_int16_t(packet->payload, 10) == htons(POINT_VERSION)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Point_Version \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* BUILD_NUM */ if (get_u_int16_t(packet->payload, 10) == htons(BUILD_NUM)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Build_Num \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* CLIENT_RECONNECT */ if (get_u_int16_t(packet->payload, 10) == htons(CLIENT_RECONNECT)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR - Client_Reconnect \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } /* Messages using the FLAP connection, usually a SNAC message. DATA -> FLAP__DATA_FRAME +-------------------------+ + FLAP__Header | 6 byte + + SNAC__Header | 10 byte + + snac | + +-------------------------+ SNAC__Header +----------------------------------------------+ + ID | 4 byte (2 foodgroup + 2 type) + + FLAGS | 2 byte + + requestId | 4 byte + +----------------------------------------------+ */ if (channel == DATA) { if (packet->payload_packet_len >= 8) family = get_u_int16_t(packet->payload, 6); else family = 0; if (packet->payload_packet_len >= 10) type = get_u_int16_t(packet->payload, 8); else type = 0; if (family == 0 || type == 0) { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OSCAR); return; } /* Family 0x0001 */ if (family == htons(GE_SE_CTL)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; case (0x000a): break; case (0x000b): break; case (0x000c): break; case (0x000d): break; case (0x000e): break; case (0x000f): break; case (0x0010): break; case (0x0011): break; case (0x0012): break; case (0x0013): break; case (0x0014): break; case (0x0015): break; case (0x0016): break; case (0x0017): break; case (0x0018): break; case (0x001e): break; case (0x001f): break; case (0x0020): break; case (0x0021): break; default: excluded = 1; } } /* Family 0x0002 */ if (family == htons(LOC_SRV)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; case (0x000a): break; case (0x000b): break; case (0x000c): break; case (0x000f): break; case (0x0010): break; case (0x0015): break; default: excluded = 1; } } /* Family 0x0003 */ if (family == htons(BUDDY_LIST)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; case (0x000a): break; case (0x000b): break; case (0x000c): break; default: excluded = 1; } } /* Family 0x0004 */ if (family == htons(IM)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; case (0x000a): break; case (0x000b): break; case (0x000c): break; case (0x0014): break; default: excluded = 1; } } /* Family 0x0006 */ if (family == htons(IS)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; default: excluded = 1; } } /* Family 0x0007 */ if (family == htons(ACC_ADM)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; default: excluded = 1; } } /* Family 0x0008 */ if (family == htons(POPUP)) { switch (type) { case (0x0001): break; case (0x0002): break; default: excluded = 1; } } /* Family 0x0009 */ if (family == htons(PMS)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; case (0x000a): break; case (0x000b): break; default: excluded = 1; } } /* Family 0x000b */ if (family == htons(USS)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; default: excluded = 1; } } /* Family 0x000d */ if (family == htons(CHAT_ROOM_SETUP)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; default: excluded = 1; } } /* Family 0x000e */ if (family == htons(CHAT_ROOM_ACT)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; default: excluded = 1; } } /* Family 0x000f */ if (family == htons(USER_SRCH)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; default: excluded = 1; } } /* Family 0x0010 */ if (family == htons(BUDDY_ICON_SERVER)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; default: excluded = 1; } } /* Family 0x0013 */ if (family == htons(SERVER_STORED_INFO)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x0008): break; case (0x0009): break; case (0x000a): break; case (0x000e): break; case (0x000f): break; case (0x0011): break; case (0x0012): break; case (0x0014): break; case (0x0015): break; case (0x0016): break; case (0x0018): break; case (0x001a): break; case (0x001b): break; case (0x001c): break; default: excluded = 1; } } /* Family 0x0015 */ if (family == htons(ICQ)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; default: excluded = 1; } } /* Family 0x0017 */ if (family == htons(INIT_AUTH)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; case (0x0004): break; case (0x0005): break; case (0x0006): break; case (0x0007): break; case (0x000a): break; case (0x000b): break; default: excluded = 1; } } /* Family 0x0018 */ if (family == htons(EMAIL)) { /* TODO */ } /* Family 0x0085 */ if (family == htons(IS_EXT)) { switch (type) { case (0x0001): break; case (0x0002): break; case (0x0003): break; default: excluded = 1; } } if(excluded == 1) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "exclude oscar.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OSCAR); } /* flag */ if (packet->payload_packet_len >= 12) { flag = get_u_int16_t(packet->payload, 10); if (flag == htons(0x0000)|| flag == htons(0x8000) || flag == htons(0x0001)) { if (packet->payload_packet_len >= 16) { /* request ID */ req_ID = get_u_int32_t(packet->payload, 12); if((req_ID <= ((u_int32_t)-1))) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR Detected \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } } } } /* ERROR -> FLAP__ERROR_CHANNEL_0x03 A FLAP error - rare */ if (channel == O_ERROR) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR Detected - Error frame \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* Close down the FLAP connection gracefully. SIGNOFF: FLAP__SIGNOFF_CHANNEL_0x04 */ if (channel == SIGNOFF) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR Detected - Signoff frame \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } /* Send a heartbeat to server to help keep connection open. KEEP_ALIVE: FLAP__KEEP_ALIVE_CHANNEL_0x05 */ if (channel == KEEP_ALIVE) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR Detected - Keep Alive frame \n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } /* detect http connections */ if (packet->payload_packet_len >= 18) { if ((packet->payload[0] == 'P') && (memcmp(packet->payload, "POST /photo/upload", 18) == 0)) { NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct, flow, packet); if (packet->host_line.len >= 18 && packet->host_line.ptr != NULL) { if (memcmp(packet->host_line.ptr, "lifestream.aol.com", 18) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR over HTTP found, POST method\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } } } if (packet->payload_packet_len > 40) { if ((packet->payload[0] == 'G') && (memcmp(packet->payload, "GET /", 5) == 0)) { if ((memcmp(&packet->payload[5], "aim/fetchEvents?aimsid=", 23) == 0) || (memcmp(&packet->payload[5], "aim/startSession?", 17) == 0) || (memcmp(&packet->payload[5], "aim/gromit/aim_express", 22) == 0) || (memcmp(&packet->payload[5], "b/ss/aolwpaim", 13) == 0) || (memcmp(&packet->payload[5], "hss/storage/aimtmpshare", 23) == 0)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR over HTTP found, GET /aim/\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } if ((memcmp(&packet->payload[5], "aim", 3) == 0) || (memcmp(&packet->payload[5], "im", 2) == 0)) { NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct, flow, packet); if (packet->user_agent_line.len > 15 && packet->user_agent_line.ptr != NULL && ((memcmp(packet->user_agent_line.ptr, "mobileAIM/", 10) == 0) || (memcmp(packet->user_agent_line.ptr, "ICQ/", 4) == 0) || (memcmp(packet->user_agent_line.ptr, "mobileICQ/", 10) == 0) || (memcmp(packet->user_agent_line.ptr, "AIM%20Free/", NDPI_STATICSTRING_LEN("AIM%20Free/")) == 0) || (memcmp(packet->user_agent_line.ptr, "AIM/", 4) == 0))) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR over HTTP found\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct, flow, packet); if (packet->referer_line.ptr != NULL && packet->referer_line.len >= 22) { if (memcmp(&packet->referer_line.ptr[packet->referer_line.len - NDPI_STATICSTRING_LEN("WidgetMain.swf")], "WidgetMain.swf", NDPI_STATICSTRING_LEN("WidgetMain.swf")) == 0) { u_int16_t i; for (i = 0; i < (packet->referer_line.len - 22); i++) { if (packet->referer_line.ptr[i] == 'a') { if (memcmp(&packet->referer_line.ptr[i + 1], "im/gromit/aim_express", 21) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR over HTTP found : aim/gromit/aim_express\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } } } } } if (memcmp(packet->payload, "CONNECT ", 8) == 0) { if (memcmp(packet->payload, "CONNECT login.icq.com:443 HTTP/1.", 33) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR ICQ-HTTP FOUND\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } if (memcmp(packet->payload, "CONNECT login.oscar.aol.com:5190 HTTP/1.", 40) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR AIM-HTTP FOUND\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } } if (packet->payload_packet_len > 43 && memcmp(packet->payload, "GET http://http.proxy.icq.com/hello HTTP/1.", 43) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR ICQ-HTTP PROXY FOUND\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 46 && memcmp(packet->payload, "GET http://aimhttp.oscar.aol.com/hello HTTP/1.", 46) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR AIM-HTTP PROXY FOUND\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 5 && get_u_int32_t(packet->payload, 0) == htonl(0x05010003)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "Maybe OSCAR Picturetransfer\n"); return; } if (packet->payload_packet_len == 10 && get_u_int32_t(packet->payload, 0) == htonl(0x05000001) && get_u_int32_t(packet->payload, 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "Maybe OSCAR Picturetransfer\n"); return; } if (packet->payload_packet_len >= 70 && memcmp(&packet->payload[packet->payload_packet_len - 26], "\x67\x00\x65\x00\x74\x00\x43\x00\x61\x00\x74\x00\x61\x00\x6c\x00\x6f\x00\x67", 19) == 0) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR PICTURE TRANSFER\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } if (NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_OSCAR) != 0) { if (flow->packet_counter == 1 && ((packet->payload_packet_len == 9 && memcmp(packet->payload, "\x00\x09\x00\x00\x83\x01\xc0\x00\x00", 9) == 0) || (packet->payload_packet_len == 13 && (memcmp(packet->payload, "\x00\x0d\x00\x87\x01\xc0", 6) == 0 || memcmp(packet->payload, "\x00\x0d\x00\x87\x01\xc1", 6) == 0)))) { flow->oscar_video_voice = 1; } if (flow->oscar_video_voice && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len && packet->payload[2] == 0x00 && packet->payload[3] == 0x00) { } if (packet->payload_packet_len >= 70 && ntohs(get_u_int16_t(packet->payload, 4)) == packet->payload_packet_len) { if (memcmp(packet->payload, "OFT", 3) == 0 && ((packet->payload[3] == '3' && ((memcmp(&packet->payload[4], "\x01\x00\x01\x01", 4) == 0) || (memcmp(&packet->payload[6], "\x01\x01\x00", 3) == 0))) || (packet->payload[3] == '2' && ((memcmp(&packet->payload[6], "\x01\x01", 2) == 0) )))) { // FILE TRANSFER PATTERN:: OFT3 or OFT2 NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR FILE TRANSFER\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } if (memcmp(packet->payload, "ODC2", 4) == 0 && memcmp(&packet->payload[6], "\x00\x01\x00\x06", 4) == 0) { //PICTURE TRANSFER PATTERN EXMAPLE:: //4f 44 43 32 00 4c 00 01 00 06 00 00 00 00 00 00 ODC2.L.......... NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR PICTURE TRANSFER\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); return; } } if (packet->payload_packet_len > 40 && (memcmp(&packet->payload[2], "\x04\x4a\x00", 3) == 0) && (memcmp(&packet->payload[6], "\x00\x00", 2) == 0) && packet->payload[packet->payload_packet_len - 15] == 'F' && packet->payload[packet->payload_packet_len - 12] == 'L' && (memcmp(&packet->payload[packet->payload_packet_len - 6], "DEST", 4) == 0) && (memcmp(&packet->payload[packet->payload_packet_len - 2], "\x00\x00", 2) == 0)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR PICTURE TRANSFER\n"); ndpi_int_oscar_add_connection(ndpi_struct, flow); if (ntohs(packet->tcp->dest) == 443 || ntohs(packet->tcp->source) == 443) { flow->oscar_ssl_voice_stage = 1; } return; } } if (flow->packet_counter < 3 && packet->payload_packet_len > 11 && (memcmp(packet->payload, "\x00\x37\x04\x4a", 4) || memcmp(packet->payload, "\x00\x0a\x04\x4a", 4))) { return; } if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_OSCAR) { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_OSCAR); return; } } void ndpi_search_oscar(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->tcp != NULL) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR :: TCP\n"); ndpi_search_oscar_tcp_connect(ndpi_struct, flow); } } void init_oscar_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Oscar", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_OSCAR, ndpi_search_oscar, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/pando.c000066400000000000000000000166661321103654100170100ustar00rootroot00000000000000/* * pando.c * * Copyright (C) 2014 Tomasz Bujlow * * The signature is based on the Libprotoident library. * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_PANDO static void ndpi_int_pando_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PANDO, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_pando_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if (ndpi_match_strprefix(packet->payload, payload_len, "\x0ePan")) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "Found PANDO.\n"); ndpi_int_pando_add_connection(ndpi_struct, flow); } } static void ndpi_check_pando_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Check if we so far detected the protocol in the request or not. */ if (flow->pando_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "PANDO stage 0: \n"); if ((payload_len >= 4) && (packet->payload[0] == 0x00) && (packet->payload[1] == 0x00) && (packet->payload[2] == 0x00) && (packet->payload[3] == 0x09)) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "Possible PANDO request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pando_stage = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 return; } if (ndpi_match_strprefix(packet->payload, payload_len, "UDPA")) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "Possible PANDO request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pando_stage = packet->packet_direction + 3; // packet_direction 0: stage 3, packet_direction 1: stage 4 return; } if (ndpi_match_strprefix(packet->payload, payload_len, "UDPR") || ndpi_match_strprefix(packet->payload, payload_len, "UDPE")) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "Possible PANDO request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pando_stage = packet->packet_direction + 5; // packet_direction 0: stage 5, packet_direction 1: stage 6 return; } } else if ((flow->pando_stage == 1) || (flow->pando_stage == 2)) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "PANDO stage %u: \n", flow->pando_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pando_stage - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 0) || ((payload_len >= 4) && (packet->payload[0] == 0x00) && (packet->payload[1] == 0x00) && (packet->payload[2] == 0x00) && (packet->payload[3] == 0x09))) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "Found PANDO.\n"); ndpi_int_pando_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PANDO, resetting the stage to 0...\n"); flow->pando_stage = 0; } } else if ((flow->pando_stage == 3) || (flow->pando_stage == 4)) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "PANDO stage %u: \n", flow->pando_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pando_stage - packet->packet_direction) == 3) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 0) || (ndpi_match_strprefix(packet->payload, payload_len, "UDPR") || ndpi_match_strprefix(packet->payload, payload_len, "UDPE"))) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "Found PANDO.\n"); ndpi_int_pando_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PANDO, resetting the stage to 0...\n"); flow->pando_stage = 0; } } else if ((flow->pando_stage == 5) || (flow->pando_stage == 6)) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "PANDO stage %u: \n", flow->pando_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pando_stage - packet->packet_direction) == 5) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if (ndpi_match_strprefix(packet->payload, payload_len, "UDPA")) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "Found PANDO.\n"); ndpi_int_pando_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PANDO, resetting the stage to 0...\n"); flow->pando_stage = 0; } } } void ndpi_search_pando(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* Break after 20 packets. */ if (flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_TRACE, "PANDO excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_PANDO); return; } /* skip marked or retransmitted packets */ if (packet->tcp_retransmission != 0) { return; } if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_PANDO) { return; } NDPI_LOG(NDPI_PROTOCOL_PANDO, ndpi_struct, NDPI_LOG_TRACE, "PANDO detection...\n"); ndpi_check_pando_tcp(ndpi_struct, flow); if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_PANDO) { return; } ndpi_check_pando_udp(ndpi_struct, flow); } void init_pando_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Pando_Media_Booster", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_PANDO, ndpi_search_pando, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/pcanywhere.c000066400000000000000000000046701321103654100200440ustar00rootroot00000000000000/* * pcanywhere.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_PCANYWHERE static void ndpi_int_pcanywhere_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PCANYWHERE, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_pcanywhere(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->udp != NULL && packet->udp->dest == htons(5632) && packet->payload_packet_len == 2 && (memcmp(packet->payload, "NQ", 2) == 0 || memcmp(packet->payload, "ST", 2) == 0)) { NDPI_LOG(NDPI_PROTOCOL_PCANYWHERE, ndpi_struct, NDPI_LOG_DEBUG, "PC Anywhere name or status query detected.\n"); ndpi_int_pcanywhere_add_connection(ndpi_struct, flow); return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_PCANYWHERE); } void init_pcanywhere_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("PcAnywhere", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_PCANYWHERE, ndpi_search_pcanywhere, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/postgres.c000066400000000000000000000121001321103654100175300ustar00rootroot00000000000000/* * postgres.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_POSTGRES static void ndpi_int_postgres_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_POSTGRES, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_postgres_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int16_t size; if (flow->l4.tcp.postgres_stage == 0) { //SSL if (packet->payload_packet_len > 7 && packet->payload[4] == 0x04 && packet->payload[5] == 0xd2 && packet->payload[6] == 0x16 && packet->payload[7] == 0x2f && ntohl(get_u_int32_t(packet->payload, 0)) == packet->payload_packet_len) { flow->l4.tcp.postgres_stage = 1 + packet->packet_direction; return; } //no SSL if (packet->payload_packet_len > 7 && //protocol version number - to be updated ntohl(get_u_int32_t(packet->payload, 4)) < 0x00040000 && ntohl(get_u_int32_t(packet->payload, 0)) == packet->payload_packet_len) { flow->l4.tcp.postgres_stage = 3 + packet->packet_direction; return; } } else { if (flow->l4.tcp.postgres_stage == 2 - packet->packet_direction) { //SSL accepted if (packet->payload_packet_len == 1 && packet->payload[0] == 'S') { NDPI_LOG(NDPI_PROTOCOL_POSTGRES, ndpi_struct, NDPI_LOG_DEBUG, "PostgreSQL detected, SSL accepted.\n"); ndpi_int_postgres_add_connection(ndpi_struct, flow); return; } //SSL denied if (packet->payload_packet_len == 1 && packet->payload[0] == 'N') { NDPI_LOG(NDPI_PROTOCOL_POSTGRES, ndpi_struct, NDPI_LOG_DEBUG, "PostgreSQL detected, SSL denied.\n"); ndpi_int_postgres_add_connection(ndpi_struct, flow); return; } } //no SSL if (flow->l4.tcp.postgres_stage == 4 - packet->packet_direction) if (packet->payload_packet_len > 8 && ntohl(get_u_int32_t(packet->payload, 5)) < 10 && ntohl(get_u_int32_t(packet->payload, 1)) == packet->payload_packet_len - 1 && packet->payload[0] == 0x52) { NDPI_LOG(NDPI_PROTOCOL_POSTGRES, ndpi_struct, NDPI_LOG_DEBUG, "PostgreSQL detected, no SSL.\n"); ndpi_int_postgres_add_connection(ndpi_struct, flow); return; } if (flow->l4.tcp.postgres_stage == 6 && ntohl(get_u_int32_t(packet->payload, 1)) == packet->payload_packet_len - 1 && packet->payload[0] == 'p') { NDPI_LOG(NDPI_PROTOCOL_POSTGRES, ndpi_struct, NDPI_LOG_DEBUG, "found postgres asymmetrically.\n"); ndpi_int_postgres_add_connection(ndpi_struct, flow); return; } if (flow->l4.tcp.postgres_stage == 5 && packet->payload[0] == 'R') { if (ntohl(get_u_int32_t(packet->payload, 1)) == packet->payload_packet_len - 1) { NDPI_LOG(NDPI_PROTOCOL_POSTGRES, ndpi_struct, NDPI_LOG_DEBUG, "found postgres asymmetrically.\n"); ndpi_int_postgres_add_connection(ndpi_struct, flow); return; } size = (u_int16_t)ntohl(get_u_int32_t(packet->payload, 1)) + 1; if (packet->payload[size - 1] == 'S') { if ((size + get_u_int32_t(packet->payload, (size + 1))) == packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_POSTGRES, ndpi_struct, NDPI_LOG_DEBUG, "found postgres asymmetrically.\n"); ndpi_int_postgres_add_connection(ndpi_struct, flow); return; } } size += get_u_int32_t(packet->payload, (size + 1)) + 1; if (packet->payload[size - 1] == 'S') { NDPI_LOG(NDPI_PROTOCOL_POSTGRES, ndpi_struct, NDPI_LOG_DEBUG, "found postgres asymmetrically.\n"); ndpi_int_postgres_add_connection(ndpi_struct, flow); return; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_POSTGRES); } void init_postgres_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("PostgreSQL", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_POSTGRES, ndpi_search_postgres_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/pplive.c000066400000000000000000000245171321103654100172000ustar00rootroot00000000000000/* * pplive.c * * Copyright (C) 2014 Tomasz Bujlow * * The signature is mostly based on the Libprotoident library * except the detection of HTTP Steam flows. * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_PPLIVE static void ndpi_int_pplive_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PPLIVE, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_pplive_udp1(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Check if we so far detected the protocol in the request or not. */ if (flow->pplive_stage1 == 0) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage 0: \n"); if (ndpi_match_strprefix(packet->payload, payload_len, "\xe9\x03\x41\x01")) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Possible PPLIVE request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pplive_stage1 = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 return; } if (ndpi_match_strprefix(packet->payload, payload_len, "\xe9\x03\x42\x01")) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Possible PPLIVE request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pplive_stage1 = packet->packet_direction + 3; // packet_direction 0: stage 3, packet_direction 1: stage 4 return; } if (ndpi_match_strprefix(packet->payload, payload_len, "\x1c\x1c\x32\x01")) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Possible PPLIVE request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pplive_stage1 = packet->packet_direction + 5; // packet_direction 0: stage 5, packet_direction 1: stage 6 return; } } else if ((flow->pplive_stage1 == 1) || (flow->pplive_stage1 == 2)) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage %u: \n", flow->pplive_stage1); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pplive_stage1 - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if (ndpi_match_strprefix(packet->payload, payload_len, "\xe9\x03\x42\x01") || ndpi_match_strprefix(packet->payload, payload_len, "\xe9\x03\x41\x01")) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Found PPLIVE.\n"); ndpi_int_pplive_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PPLIVE, resetting the stage to 0...\n"); flow->pplive_stage1 = 0; } } else if ((flow->pplive_stage1 == 3) || (flow->pplive_stage1 == 4)) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage %u: \n", flow->pplive_stage1); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pplive_stage1 - packet->packet_direction) == 3) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if (ndpi_match_strprefix(packet->payload, payload_len, "\xe9\x03\x41\x01")) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Found PPLIVE.\n"); ndpi_int_pplive_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PPLIVE, resetting the stage to 0...\n"); flow->pplive_stage1 = 0; } } else if ((flow->pplive_stage1 == 5) || (flow->pplive_stage1 == 6)) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage %u: \n", flow->pplive_stage1); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pplive_stage1 - packet->packet_direction) == 5) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if (ndpi_match_strprefix(packet->payload, payload_len, "\x1c\x1c\x32\x01")) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Found PPLIVE.\n"); ndpi_int_pplive_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PPLIVE, resetting the stage to 0...\n"); flow->pplive_stage1 = 0; } } } static void ndpi_check_pplive_udp2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Check if we so far detected the protocol in the request or not. */ if (flow->pplive_stage2 == 0) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage 0: \n"); if ((payload_len == 57) && ndpi_match_strprefix(packet->payload, payload_len, "\xe9\x03\x41\x01")) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Possible PPLIVE request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pplive_stage2 = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 } } else { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage %u: \n", flow->pplive_stage2); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pplive_stage2 - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if (payload_len == 0) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Found PPLIVE.\n"); ndpi_int_pplive_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PPLIVE, resetting the stage to 0...\n"); flow->pplive_stage2 = 0; } } } static void ndpi_check_pplive_udp3(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Check if we so far detected the protocol in the request or not. */ if (flow->pplive_stage3 == 0) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage 0: \n"); if ((payload_len == 94) && (packet->udp->dest == htons(5041) || packet->udp->source == htons(5041) || packet->udp->dest == htons(8303) || packet->udp->source == htons(8303))) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Possible PPLIVE request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->pplive_stage3 = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 return; } } else { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE stage %u: \n", flow->pplive_stage3); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->pplive_stage3 - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 0) || (payload_len == 49) ||(payload_len == 94)) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Found PPLIVE.\n"); ndpi_int_pplive_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to PPLIVE, resetting the stage to 0...\n"); flow->pplive_stage3 = 0; } } } void ndpi_search_pplive(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* Break after 20 packets. */ if (flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "Exclude PPLIVE.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_PPLIVE); return; } if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_PPLIVE) { return; } NDPI_LOG(NDPI_PROTOCOL_PPLIVE, ndpi_struct, NDPI_LOG_DEBUG, "PPLIVE detection...\n"); ndpi_check_pplive_udp1(ndpi_struct, flow); if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_PPLIVE) { return; } ndpi_check_pplive_udp2(ndpi_struct, flow); if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_PPLIVE) { return; } ndpi_check_pplive_udp3(ndpi_struct, flow); } void init_pplive_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("PPLive", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_PPLIVE, ndpi_search_pplive, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ppstream.c000066400000000000000000000201451321103654100175250ustar00rootroot00000000000000/* * ppstream.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_PPSTREAM #define PPS_PORT 17788 static void ndpi_int_ppstream_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PPSTREAM, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_ppstream(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /** PPS over TCP is detected inside HTTP dissector */ /* check PPS over UDP */ if(packet->udp != NULL) { /*** on port 17788 ***/ if(packet->payload_packet_len > 12 && ((ntohs(packet->udp->source) == PPS_PORT) || (ntohs(packet->udp->dest) == PPS_PORT))) { if(((packet->payload_packet_len - 4 == get_l16(packet->payload, 0)) || (packet->payload_packet_len == get_l16(packet->payload, 0)) || (packet->payload_packet_len >= 6 && packet->payload_packet_len - 6 == get_l16(packet->payload, 0)))) { /* check 43 and */ if(packet->payload[2] == 0x43) { if(packet->payload[5] == 0xff && packet->payload[6] == 0x00 && packet->payload[7] == 0x01 && packet->payload[8] == 0x00 && packet->payload[9] == 0x00 && packet->payload[10] == 0x00 && packet->payload[11] == 0x00 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } /* check 44 */ else if(packet->payload[2] == 0x44) { /** b1 71 **/ if(packet->payload[3] == 0xb1 && packet->payload[4] == 0x71) { if(packet->payload[13] == 0x00 && packet->payload[14] == 0x00 && packet->payload[15] == 0x01 && packet->payload[16] == 0x00) { /* 02 03 04 05 */ if(packet->payload[17] == 0x02 || packet->payload[17] == 0x03 || packet->payload[17] == 0x04 || packet->payload[17] == 0x05) { if(packet->payload[18] == 0x00 && packet->payload[19] == 0x00 && packet->payload[20] == 0x00) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } } /* ff */ else if(packet->payload[17] == 0xff) { if(packet->payload[18] == 0xff && packet->payload[19] == 0xff && packet->payload[20] == 0xff) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } } } } /** 73 17 **/ else if(packet->payload[3] == 0x73 && packet->payload[4] == 0x17) { if(packet->payload[5] == 0x00 && packet->payload[6] == 0x00 && packet->payload[7] == 0x00 && packet->payload[8] == 0x00 && packet->payload[14] == 0x00 && packet->payload[15] == 0x00 && packet->payload[16] == 0x00 && packet->payload[17] == 0x00 && packet->payload[18] == 0x00 && packet->payload[19] == 0x00 && packet->payload[20] == 0x00) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } } /** 74 71 **/ else if(packet->payload[3] == 0x74 && packet->payload[4] == 0x71 && packet->payload_packet_len == 113) { /* check "PPStream" string in hex */ if(packet->payload[94] == 0x50 && packet->payload[95] == 0x50 && packet->payload[96] == 0x53 && packet->payload[97] == 0x74 && packet->payload[98] == 0x72 && packet->payload[99] == 0x65 && packet->payload[100] == 0x61 && packet->payload[101] == 0x6d) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } } } /** check 55 (1) **/ else if(packet->payload[2] == 0x55 && (packet->payload[13] == 0x1b && packet->payload[14] == 0xa0 && packet->payload[15] == 0x00 && packet->payload[16] == 0x00 && packet->payload[17] == 0x00 && packet->payload[18] == 0x00 && packet->payload[19] == 0x00 && packet->payload[20] == 0x00 )) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } /** check 55 (2) **/ else if(packet->payload[2] == 0x55 && packet->payload[1] == 0x00 && (packet->payload[5] == 0x00 && packet->payload[6] == 0x00 && packet->payload[7] == 0x00 && packet->payload[8] == 0x00 && packet->payload[14] == 0x00 && packet->payload[15] == 0x00 && packet->payload[16] == 0x00 && packet->payload[17] == 0x00 && packet->payload[18] == 0x00 && packet->payload[19] == 0x00 && packet->payload[20] == 0x00 )) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } } } /* No port detection */ if(packet->payload_packet_len > 17) { /* 80 */ if(packet->payload[1] == 0x80 || packet->payload[1] == 0x84 ) { if(packet->payload[3] == packet->payload[4]) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over UDP.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } } /* 53 */ else if(packet->payload[1] == 0x53 && packet->payload[3] == 0x00 && (packet->payload[0] == 0x08 || packet->payload[0] == 0x0c)) { /* increase count pkt ppstream over udp */ flow->l4.udp.ppstream_stage++; NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "found PPStream over udp.\n"); ndpi_int_ppstream_add_connection(ndpi_struct, flow); return; } } } /* EXCLUDE PPS */ NDPI_LOG(NDPI_PROTOCOL_PPSTREAM, ndpi_struct, NDPI_LOG_DEBUG, "exclude PPStream.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_PPSTREAM); } } void init_ppstream_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("PPStream", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_PPSTREAM, ndpi_search_ppstream, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/pptp.c000066400000000000000000000051231321103654100166540ustar00rootroot00000000000000/* * pptp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* include files */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_PPTP static void ndpi_int_pptp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_PPTP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_pptp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len >= 10 && get_u_int16_t(packet->payload, 0) == htons(packet->payload_packet_len) && get_u_int16_t(packet->payload, 2) == htons(0x0001) /* message type: control message */ &&get_u_int32_t(packet->payload, 4) == htonl(0x1a2b3c4d) /* cookie: correct */ &&(get_u_int16_t(packet->payload, 8) == htons(0x0001) /* control type: start-control-connection-request */ )) { NDPI_LOG(NDPI_PROTOCOL_PPTP, ndpi_struct, NDPI_LOG_DEBUG, "found pptp.\n"); ndpi_int_pptp_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_PPTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude pptp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_PPTP); } void init_pptp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("PPTP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_PPTP, ndpi_search_pptp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/qq.c000066400000000000000000000575551321103654100163320ustar00rootroot00000000000000/* * qq.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_QQ static void ndpi_int_qq_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QQ, NDPI_PROTOCOL_UNKNOWN); } /* * a qq client packet looks like this: * * TCP packets starts with 16 bit length, then the normal packets follows * * 0 1 byte packet tag (usually 0x02) * 1 2 byte client tag (client version) * 3 2 byte command * 5 2 byte sequence number * 7 4 byte userid * 11 x bytes data * LAST 1 byte packet tail (usually 0x03) * * a qq server packet looks like this: * * TCP packets starts with 16 bit length, then the normal packets follows * * 0 1 byte packet tag (usually 0x02) * 1 2 byte source tag (client version, might also be a server id) * 3 2 byte command (usually reply to client request, so same command id) * 5 2 byte sequence number * LAST 1 byte packet tail (usually 0x03) * * NOTE: there are other qq versions which uses different packet types! */ /* * these are some currently known client ids (or server ids) * new ids might be added here if the traffic is really QQ */ static const u_int16_t ndpi_valid_qq_versions[] = { 0x0100, 0x05a5, 0x062e, 0x06d5, 0x072e, 0x0801, 0x087d, 0x08d2, 0x0961, 0x0a1d, 0x0b07, 0x0b2f, 0x0b35, 0x0b37, 0x0c0b, 0x0c0d, 0x0c21, 0x0c49, 0x0d05, 0x0d51, 0x0d55, 0x0d61, 0x0e1b, 0x0e35, 0x0f15, 0x0f4b, 0x0f5f, 0x1105, 0x111b, 0x111d, 0x1131, 0x113f, 0x115b, 0x1203, 0x1205, 0x120b, 0x1251, 0x1412, 0x1441, 0x1501, 0x1549, 0x163a, 0x1801, 0x180d, 0x1c27, 0x1e0d }; /** * this functions checks whether the packet is a valid qq packet * it can handle tcp and udp packets */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_is_valid_qq_packet(const struct ndpi_packet_struct *packet) { u_int8_t real_start = 0; u_int16_t command; u_int8_t ids, found = 0; u_int16_t version_id; if (packet->payload_packet_len < 9) return 0; /* for tcp the length is prefixed */ if (packet->tcp) { if (ntohs(get_u_int16_t(packet->payload, 0)) != packet->payload_packet_len) { return 0; } real_start = 2; } /* packet usually starts with 0x02 */ if (packet->payload[real_start] != 0x02) { return 0; } /* packet usually ends with 0x03 */ if (packet->payload[packet->payload_packet_len - 1] != 0x03) { return 0; } version_id = ntohs(get_u_int16_t(packet->payload, real_start + 1)); if (version_id == 0) { return 0; } /* check for known version id */ for (ids = 0; ids < sizeof(ndpi_valid_qq_versions) / sizeof(ndpi_valid_qq_versions[0]); ids++) { if (version_id == ndpi_valid_qq_versions[ids]) { found = 1; break; } } if (!found) return 0; command = ntohs(get_u_int16_t(packet->payload, real_start + 3)); /* these are some known commands, not all need to be checked since many are used with already established connections */ switch (command) { case 0x0091: /* get server */ case 0x00ba: /* login token */ case 0x00dd: /* password verify */ case 0x00e5: case 0x00a4: case 0x0030: case 0x001d: case 0x0001: case 0x0062: case 0x0002: case 0x0022: case 0x0029: break; default: return 0; break; } return 1; } /* * some file transfer packets look like this * * 0 1 byte packet tag (usually 0x04) * 1 2 byte client tag (client version) * 3 2 byte length (this is speculative) * LAST 1 byte packet tail (usually 0x03) * */ /** * this functions checks whether the packet is a valid qq file transfer packet * it can handle tcp and udp packets */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_is_valid_qq_ft_packet(const struct ndpi_packet_struct *packet) { u_int8_t ids, found = 0; u_int16_t version_id; if (packet->payload_packet_len < 9) return 0; /* file transfer packets may start with 0x00 (control), 0x03 (data), 0x04 (agent) */ if (packet->payload[0] != 0x04 && packet->payload[0] != 0x03 && packet->payload[0] != 0x00) { return 0; } version_id = ntohs(get_u_int16_t(packet->payload, 1)); if (version_id == 0) { return 0; } /* check for known version id */ for (ids = 0; ids < sizeof(ndpi_valid_qq_versions) / sizeof(ndpi_valid_qq_versions[0]); ids++) { if (version_id == ndpi_valid_qq_versions[ids]) { found = 1; break; } } if (!found) return 0; if (packet->payload[0] == 0x04) { if (ntohs(get_u_int16_t(packet->payload, 3)) != packet->payload_packet_len) { return 0; } /* packet usually ends with 0x03 */ if (packet->payload[packet->payload_packet_len - 1] != 0x03) { return 0; } } else if (packet->payload[0] == 0x03) { /* TODO currently not detected */ return 0; } else if (packet->payload[0] == 0x00) { /* packet length check, there might be other lengths */ if (packet->payload_packet_len != 84) { return 0; } /* packet usually ends with 0x0c ? */ if (packet->payload[packet->payload_packet_len - 1] != 0x0c) { return 0; } } return 1; } static void ndpi_search_qq_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; static const u_int16_t p8000_patt_02[13] = // maybe version numbers { 0x1549, 0x1801, 0x180d, 0x0961, 0x01501, 0x0e35, 0x113f, 0x0b37, 0x1131, 0x163a, 0x1e0d, 0x3619,}; u_int16_t no_of_patterns = 12, index = 0; NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "search qq udp.\n"); if (flow->qq_stage <= 3) { if ((packet->payload_packet_len == 27 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0300 && packet->payload[2] == 0x01) || (packet->payload_packet_len == 84 && ((ntohs(get_u_int16_t(packet->payload, 0)) == 0x000e && packet->payload[2] == 0x35) || (ntohs(get_u_int16_t(packet->payload, 0)) == 0x0015 && packet->payload[2] == 0x01) || (ntohs(get_u_int16_t(packet->payload, 0)) == 0x000b && packet->payload[2] == 0x37) || (ntohs(get_u_int16_t(packet->payload, 0)) == 0x0015 && packet->payload[2] == 0x49))) || (packet->payload_packet_len > 10 && ((get_u_int16_t(packet->payload, 0) == htons(0x000b) && packet->payload[2] == 0x37) || (get_u_int32_t(packet->payload, 0) == htonl(0x04163a00) && packet->payload[packet->payload_packet_len - 1] == 0x03 && packet->payload[4] == packet->payload_packet_len)))) { /* if (flow->qq_stage == 3 && flow->detected_protocol == NDPI_PROTOCOL_QQ) { if (flow->packet_direction_counter[0] > 0 && flow->packet_direction_counter[1] > 0) { flow->protocol_subtype = NDPI_PROTOCOL_QQ_SUBTYPE_AUDIO; return; } else if (flow->packet_counter < 10) { return; } } */ flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 030001 or 000e35 four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->payload_packet_len > 2 && (packet->payload[0] == 0x02 || packet->payload[0] == 0x04)) { u_int16_t pat = ntohs(get_u_int16_t(packet->payload, 1)); for (index = 0; index < no_of_patterns; index++) { if (pat == p8000_patt_02[index] && packet->payload[packet->payload_packet_len - 1] == 0x03) { flow->qq_stage++; // maybe we can test here packet->payload[4] == packet->payload_packet_len if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 02 ... 03 four times.\n"); /* if (packet->payload[0] == 0x04) { ndpi_int_qq_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL); return; } */ ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } } } if (packet->payload_packet_len == 84 && (packet->payload[0] == 0 || packet->payload[0] == 0x03)) { u_int16_t pat = ntohs(get_u_int16_t(packet->payload, 1)); for (index = 0; index < no_of_patterns; index++) { if (pat == p8000_patt_02[index]) { flow->qq_stage++; /* if (flow->qq_stage == 3 && flow->packet_direction_counter[0] > 0 && flow->packet_direction_counter[1] > 0) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow, NDPI_REAL_PROTOCOL); return; } else */ if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } } } if (packet->payload_packet_len > 2 && packet->payload[0] == 0x04 && ((ntohs(get_u_int16_t(packet->payload, 1)) == 0x1549 || ntohs(get_u_int16_t(packet->payload, 1)) == 0x1801 || ntohs(get_u_int16_t(packet->payload, 1)) == 0x0961) || (packet->payload_packet_len > 16 && (ntohs(get_u_int16_t(packet->payload, 1)) == 0x180d || ntohs(get_u_int16_t(packet->payload, 1)) == 0x096d) && ntohl(get_u_int32_t(packet->payload, 12)) == 0x28000000 && ntohs(get_u_int16_t(packet->payload, 3)) == packet->payload_packet_len)) && packet->payload[packet->payload_packet_len - 1] == 0x03) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 04 1159 ... 03 four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->payload_packet_len > 2 && (packet->payload[0] == 0x06 || packet->payload[0] == 0x02) && ntohs(get_u_int16_t(packet->payload, 1)) == 0x0100 && (packet->payload[packet->payload_packet_len - 1] == 0x00 || packet->payload[packet->payload_packet_len - 1] == 0x03)) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 02/06 0100 ... 03/00 four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->payload_packet_len > 2 && (packet->payload[0] == 0x02) && ntohs(get_u_int16_t(packet->payload, 1)) == 0x1131 && packet->payload[packet->payload_packet_len - 1] == 0x03) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 02 1131 ... 03 four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->payload_packet_len > 5 && get_u_int16_t(packet->payload, 0) == htons(0x0203) && ntohs(get_u_int16_t(packet->payload, 2)) == packet->payload_packet_len && get_u_int16_t(packet->payload, 4) == htons(0x0b0b)) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 0203[packet_length_0b0b] three times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->udp->dest == htons(9000) || packet->udp->source == htons(9000)) { if (packet->payload_packet_len > 3 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0202 && ntohs(get_u_int16_t(packet->payload, 2)) == packet->payload_packet_len) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 02 02 four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } } } if (ndpi_is_valid_qq_packet(packet)) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over udp.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq packet stage %d\n", flow->qq_stage); return; } if (ndpi_is_valid_qq_ft_packet(packet)) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq ft over udp.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (flow->qq_stage && flow->packet_counter <= 5) { return; } NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "QQ excluded\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QQ); } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif void ndpi_search_qq_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int16_t i = 0; // u_int16_t a = 0; NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "search qq tcp.\n"); if (packet->payload_packet_len == 39 && get_u_int32_t(packet->payload, 0) == htonl(0x27000000) && get_u_int16_t(packet->payload, 4) == htons(0x0014) && get_u_int32_t(packet->payload, 11) != 0 && get_u_int16_t(packet->payload, packet->payload_packet_len - 2) == htons(0x0000)) { if (flow->qq_stage == 4) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over tcp - maybe ft/audio/video.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } flow->qq_stage = 4; return; } if ((packet->payload_packet_len > 4 && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len && get_u_int16_t(packet->payload, 2) == htons(0x0212) && packet->payload[4] == 0x0b) || (packet->payload_packet_len > 6 && packet->payload[0] == 0x02 && packet->payload[packet->payload_packet_len - 1] == 0x03 && ntohs(get_u_int16_t(packet->payload, 1)) == packet->payload_packet_len && (get_u_int16_t(packet->payload, 3) == htons(0x0605) || get_u_int16_t(packet->payload, 3) == htons(0x0608)) && packet->payload[5] == 0x00) || (packet->payload_packet_len > 9 && get_u_int32_t(packet->payload, 0) == htonl(0x04154900) && get_l16(packet->payload, 4) == packet->payload_packet_len && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 9 && get_u_int32_t(packet->payload, 0) == htonl(0x040e3500) && get_l16(packet->payload, 4) == packet->payload_packet_len && packet->payload[9] == 0x33 && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 9 && get_u_int32_t(packet->payload, 0) == htonl(0x040e0215) && get_l16(packet->payload, 4) == packet->payload_packet_len && packet->payload[9] == 0x33 && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 6 && get_u_int32_t(packet->payload, 2) == htonl(0x020d5500) && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 6 && get_u_int16_t(packet->payload, 0) == htons(0x0418) && packet->payload[2] == 0x01 && ntohs(get_u_int16_t(packet->payload, 3)) == packet->payload_packet_len && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 6 && get_u_int16_t(packet->payload, 0) == htons(0x0411) && packet->payload[2] == 0x31 && ntohs(get_u_int16_t(packet->payload, 3)) == packet->payload_packet_len && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 6 && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len && get_u_int16_t(packet->payload, 2) == htons(0x0211) && packet->payload[4] == 0x31 && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 6 && ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len && get_u_int16_t(packet->payload, 2) == htons(0x0218) && packet->payload[4] == 0x01 && packet->payload[packet->payload_packet_len - 1] == 0x03) || (packet->payload_packet_len > 10 && get_u_int32_t(packet->payload, 0) == htonl(0x04163a00) && packet->payload[packet->payload_packet_len - 1] == 0x03 && packet->payload[4] == packet->payload_packet_len) ) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over tcp.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (ndpi_is_valid_qq_packet(packet)) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over tcp.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (ndpi_is_valid_qq_ft_packet(packet)) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq ft over tcp.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->payload_packet_len == 2) { flow->l4.tcp.qq_nxt_len = ntohs(get_u_int16_t(packet->payload, 0)); return; } if (packet->payload_packet_len > 5 && (((flow->l4.tcp.qq_nxt_len == packet->payload_packet_len + 2) && packet->payload[0] == 0x02 && packet->payload[packet->payload_packet_len - 1] == 0x03 && get_u_int16_t(packet->payload, 1) == htons(0x0f5f)) || (ntohs(get_u_int16_t(packet->payload, 0)) == packet->payload_packet_len && packet->payload[2] == 0x02 && packet->payload[packet->payload_packet_len - 1] == 0x03 && get_u_int16_t(packet->payload, 3) == htons(0x0f5f)))) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 02 ... 03 four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->payload_packet_len > 2 && packet->payload[0] == 0x04 && ((get_u_int16_t(packet->payload, 1) == htons(0x1549) || get_u_int16_t(packet->payload, 1) == htons(0x1801) || get_u_int16_t(packet->payload, 1) == htons(0x0961)) || (packet->payload_packet_len > 16 && (get_u_int16_t(packet->payload, 1) == htons(0x180d) || get_u_int16_t(packet->payload, 1) == htons(0x096d)) && get_u_int32_t(packet->payload, 12) == htonl(0x28000000) && ntohs(get_u_int16_t(packet->payload, 3)) == packet->payload_packet_len)) && packet->payload[packet->payload_packet_len - 1] == 0x03) { flow->qq_stage++; if (flow->qq_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq udp pattern 04 1159 ... 03 four times.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } return; } if (packet->payload_packet_len > 100 && ((memcmp(packet->payload, "GET", 3) == 0) || (memcmp(packet->payload, "POST", 4) == 0))) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found GET or POST.\n"); if (memcmp(packet->payload, "GET /qqfile/qq", 14) == 0) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over tcp GET /qqfile/qq.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->user_agent_line.ptr != NULL && (packet->user_agent_line.len > 7 && memcmp(packet->user_agent_line.ptr, "QQClient", 8) == 0)) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over tcp GET...QQClient\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } for (i = 0; i < packet->parsed_lines; i++) { if (packet->line[i].len > 3 && memcmp(packet->line[i].ptr, "QQ: ", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over tcp GET...QQ: \n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } } if (packet->host_line.ptr != NULL) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "host line ptr\n"); if (packet->host_line.len > 11 && memcmp(&packet->host_line.ptr[0], "www.qq.co.za", 12) == 0) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq over tcp Host: www.qq.co.za\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } } } if (flow->qq_stage == 0 && packet->payload_packet_len == 82 && get_u_int32_t(packet->payload, 0) == htonl(0x0000004e) && get_u_int32_t(packet->payload, 4) == htonl(0x01010000)) { for (i = 8; i < 82; i++) { if (packet->payload[i] != 0x00) { break; } if (i == 81) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq Mail.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } } } if (flow->qq_stage == 0 && packet->payload_packet_len == 182 && get_u_int32_t(packet->payload, 0) == htonl(0x000000b2) && get_u_int32_t(packet->payload, 4) == htonl(0x01020000) && get_u_int32_t(packet->payload, 8) == htonl(0x04015151) && get_u_int32_t(packet->payload, 12) == htonl(0x4d61696c)) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq Mail.\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 204 && flow->qq_stage == 0 && get_u_int32_t(packet->payload, 200) == htonl(0xfbffffff)) { for (i = 0; i < 200; i++) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "i = %u\n", i); if (packet->payload[i] != 0) { break; } if (i == 199) { NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "found qq chat or file transfer\n"); ndpi_int_qq_add_connection(ndpi_struct, flow); return; } } } #ifdef NDPI_PROTOCOL_HTTP if (NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) { #endif /* NDPI_PROTOCOL_HTTP */ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QQ); NDPI_LOG(NDPI_PROTOCOL_QQ, ndpi_struct, NDPI_LOG_DEBUG, "QQ tcp excluded; len %u\n", packet->payload_packet_len); #ifdef NDPI_PROTOCOL_HTTP } #endif /* NDPI_PROTOCOL_HTTP */ } void ndpi_search_qq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->udp != NULL && flow->detected_protocol_stack[0] != NDPI_PROTOCOL_QQ) ndpi_search_qq_udp(ndpi_struct, flow); if (packet->tcp != NULL && flow->detected_protocol_stack[0] != NDPI_PROTOCOL_QQ) ndpi_search_qq_tcp(ndpi_struct, flow); } void init_qq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("QQ", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_QQ, ndpi_search_qq, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/quake.c000066400000000000000000000077151321103654100170100ustar00rootroot00000000000000/* * quake.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_QUAKE static void ndpi_int_quake_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUAKE, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_quake(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if ((packet->payload_packet_len == 14 && get_u_int16_t(packet->payload, 0) == 0xffff && memcmp(&packet->payload[2], "getInfo", 7) == 0) || (packet->payload_packet_len == 17 && get_u_int16_t(packet->payload, 0) == 0xffff && memcmp(&packet->payload[2], "challenge", 9) == 0) || (packet->payload_packet_len > 20 && packet->payload_packet_len < 30 && get_u_int16_t(packet->payload, 0) == 0xffff && memcmp(&packet->payload[2], "getServers", 10) == 0)) { NDPI_LOG(NDPI_PROTOCOL_QUAKE, ndpi_struct, NDPI_LOG_DEBUG, "Quake IV detected.\n"); ndpi_int_quake_add_connection(ndpi_struct, flow); return; } /* Quake III/Quake Live */ if (packet->payload_packet_len == 15 && get_u_int32_t(packet->payload, 0) == 0xffffffff && memcmp(&packet->payload[4], "getinfo", NDPI_STATICSTRING_LEN("getinfo")) == 0) { NDPI_LOG(NDPI_PROTOCOL_QUAKE, ndpi_struct, NDPI_LOG_DEBUG, "Quake III Arena/Quake Live detected.\n"); ndpi_int_quake_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 16 && get_u_int32_t(packet->payload, 0) == 0xffffffff && memcmp(&packet->payload[4], "getchallenge", NDPI_STATICSTRING_LEN("getchallenge")) == 0) { NDPI_LOG(NDPI_PROTOCOL_QUAKE, ndpi_struct, NDPI_LOG_DEBUG, "Quake III Arena/Quake Live detected.\n"); ndpi_int_quake_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 20 && packet->payload_packet_len < 30 && get_u_int32_t(packet->payload, 0) == 0xffffffff && memcmp(&packet->payload[4], "getservers", NDPI_STATICSTRING_LEN("getservers")) == 0) { NDPI_LOG(NDPI_PROTOCOL_QUAKE, ndpi_struct, NDPI_LOG_DEBUG, "Quake III Arena/Quake Live detected.\n"); ndpi_int_quake_add_connection(ndpi_struct, flow); return; } /* ports for startup packet: Quake I 26000 (starts with 0x8000) Quake II 27910 Quake III 27960 (increases with each player) Quake IV 27650 Quake World 27500 Quake Wars ????? */ NDPI_LOG(NDPI_PROTOCOL_QUAKE, ndpi_struct, NDPI_LOG_DEBUG, "Quake excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUAKE); } void init_quake_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Quake", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_QUAKE, ndpi_search_quake, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/quic.c000066400000000000000000000104271321103654100166350ustar00rootroot00000000000000/* * quic.c * * Copyright (C) 2012-16 - ntop.org * * Based on code of: * Andrea Buscarinu - * Michele Campus - * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_QUIC static int quic_ports(u_int16_t sport, u_int16_t dport) { if ((sport == 443 || dport == 443 || sport == 80 || dport == 80) && (sport != 123 && dport != 123)) return 1; return 0; } /* ***************************************************************** */ static int quic_len(u_int8_t l) { switch(l) { case 0: return(1); break; case 1: return(2); break; case 2: return(4); break; case 3: return(8); break; } return(0); /* NOTREACHED */ } /* ***************************************************************** */ void ndpi_search_quic(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t udp_len = packet->payload_packet_len; u_int version_len = ((packet->payload[0] & 0x01) == 0) ? 0 : 4; u_int cid_len = quic_len((packet->payload[0] & 0x0C) >> 2); u_int seq_len = quic_len((packet->payload[0] & 0x30) >> 4); u_int quic_hlen = 1 /* flags */ + version_len + seq_len + cid_len; if(packet->udp != NULL && (udp_len > (quic_hlen+4 /* QXXX */)) && ((packet->payload[0] & 0xC2) == 0x00) && (quic_ports(ntohs(packet->udp->source), ntohs(packet->udp->dest))) ) { int i; if((version_len > 0) && (packet->payload[1+cid_len] != 'Q')) goto no_quic; NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "found QUIC.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_QUIC, NDPI_PROTOCOL_UNKNOWN); if(packet->payload[quic_hlen+12] != 0xA0) quic_hlen++; if(udp_len > quic_hlen + 16 + 4) { if(!strncmp((char*)&packet->payload[quic_hlen+16], "CHLO" /* Client Hello */, 4)) { /* Check if SNI (Server Name Identification) is present */ for(i=quic_hlen+12; ipayload[i] == 'S') && (packet->payload[i+1] == 'N') && (packet->payload[i+2] == 'I') && (packet->payload[i+3] == 0)) { u_int32_t offset = *((u_int32_t*)&packet->payload[i+4]); u_int32_t prev_offset = *((u_int32_t*)&packet->payload[i-4]); int len = offset-prev_offset; int sni_offset = i+prev_offset+1; while((sni_offset < udp_len) && (packet->payload[sni_offset] == '-')) sni_offset++; if((sni_offset+len) < udp_len) { int max_len = sizeof(flow->host_server_name)-1, j = 0; if(len > max_len) len = max_len; while((len > 0) && (sni_offset < udp_len)) { flow->host_server_name[j++] = packet->payload[sni_offset]; sni_offset++, len--; } ndpi_match_host_subprotocol(ndpi_struct, flow, (char *)flow->host_server_name, strlen((const char*)flow->host_server_name), NDPI_PROTOCOL_QUIC); } break; } } } } return; } no_quic: NDPI_LOG(NDPI_PROTOCOL_QUIC, ndpi_struct, NDPI_LOG_DEBUG, "exclude QUIC.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_QUIC); } /* ***************************************************************** */ void init_quic_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("QUIC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_QUIC, ndpi_search_quic, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif /* NDPI_PROTOCOL_QUIC */ nDPI-2.2/src/lib/protocols/radius.c000066400000000000000000000047231321103654100171650ustar00rootroot00000000000000/* * radius.c * * Copyright (C) 2012-15 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_RADIUS struct radius_header { u_int8_t code; u_int8_t packet_id; u_int16_t len; }; static void ndpi_check_radius(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { struct radius_header *h = (struct radius_header*)packet->payload; if((payload_len > sizeof(struct radius_header)) && (h->code > 0) && (h->code <= 5) && (ntohs(h->len) == payload_len)) { NDPI_LOG(NDPI_PROTOCOL_RADIUS, ndpi_struct, NDPI_LOG_DEBUG, "Found radius.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RADIUS, NDPI_PROTOCOL_UNKNOWN); return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RADIUS); return; } } void ndpi_search_radius(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_RADIUS, ndpi_struct, NDPI_LOG_DEBUG, "radius detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_RADIUS) ndpi_check_radius(ndpi_struct, flow); } void init_radius_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Radius", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RADIUS, ndpi_search_radius, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/rdp.c000066400000000000000000000050711321103654100164600ustar00rootroot00000000000000/* * rdp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_RDP static void ndpi_int_rdp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RDP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_rdp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len > 10 && get_u_int8_t(packet->payload, 0) > 0 && get_u_int8_t(packet->payload, 0) < 4 && get_u_int16_t(packet->payload, 2) == ntohs(packet->payload_packet_len) && get_u_int8_t(packet->payload, 4) == packet->payload_packet_len - 5 && get_u_int8_t(packet->payload, 5) == 0xe0 && get_u_int16_t(packet->payload, 6) == 0 && get_u_int16_t(packet->payload, 8) == 0 && get_u_int8_t(packet->payload, 10) == 0) { NDPI_LOG(NDPI_PROTOCOL_RDP, ndpi_struct, NDPI_LOG_DEBUG, "RDP detected.\n"); ndpi_int_rdp_add_connection(ndpi_struct, flow); return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RDP); } void init_rdp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("RDP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RDP, ndpi_search_rdp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/redis_net.c000066400000000000000000000065751321103654100176610ustar00rootroot00000000000000/* * redis.c * * Copyright (C) 2011-15 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_REDIS static void ndpi_int_redis_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_REDIS, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_redis(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if(payload_len == 0) return; /* Shouldn't happen */ /* Break after 20 packets. */ if(flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_REDIS, ndpi_struct, NDPI_LOG_DEBUG, "Exclude Redis.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_REDIS); return; } if(packet->packet_direction == 0) flow->redis_s2d_first_char = packet->payload[0]; else flow->redis_d2s_first_char = packet->payload[0]; if((flow->redis_s2d_first_char != '\0') && (flow->redis_d2s_first_char != '\0')) { /* *1 $4 PING +PONG *3 $3 SET $19 dns.cache.127.0.0.1 $9 localhost +OK */ if(((flow->redis_s2d_first_char == '*') && ((flow->redis_d2s_first_char == '+') || (flow->redis_d2s_first_char == ':'))) || ((flow->redis_d2s_first_char == '*') && ((flow->redis_s2d_first_char == '+') || (flow->redis_s2d_first_char == ':')))) { NDPI_LOG(NDPI_PROTOCOL_REDIS, ndpi_struct, NDPI_LOG_DEBUG, "Found Redis.\n"); ndpi_int_redis_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_REDIS, ndpi_struct, NDPI_LOG_DEBUG, "Exclude Redis.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_REDIS); } } else return; /* Too early */ } void ndpi_search_redis(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_REDIS, ndpi_struct, NDPI_LOG_DEBUG, "Redis detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_REDIS) { if (packet->tcp_retransmission == 0) { ndpi_check_redis(ndpi_struct, flow); } } } void init_redis_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Redis", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_REDIS, ndpi_search_redis, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/rsync.c000066400000000000000000000050231321103654100170260ustar00rootroot00000000000000/* * rsync.c * * Copyright (C) 2013 Remy Mudingay * Copyright (C) 2016 ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_RSYNC static void ndpi_int_rsync_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RSYNC, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_rsync(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_RSYNC, ndpi_struct, NDPI_LOG_DEBUG, "search for RSYNC.\n"); if(packet->tcp) { NDPI_LOG(NDPI_PROTOCOL_RSYNC, ndpi_struct, NDPI_LOG_DEBUG, "calculating RSYNC over tcp.\n"); /* * Should match: memcmp(packet->payload, "@RSYNCD: 28", 14) == 0) */ if (packet->payload_packet_len == 12 && packet->payload[0] == 0x40 && packet->payload[1] == 0x52 && packet->payload[2] == 0x53 && packet->payload[3] == 0x59 && packet->payload[4] == 0x4e && packet->payload[5] == 0x43 && packet->payload[6] == 0x44 && packet->payload[7] == 0x3a ) { NDPI_LOG(NDPI_PROTOCOL_RSYNC, ndpi_struct, NDPI_LOG_DEBUG, "found rsync.\n"); ndpi_int_rsync_add_connection(ndpi_struct, flow); } } else { NDPI_LOG(NDPI_PROTOCOL_RSYNC, ndpi_struct, NDPI_LOG_DEBUG, "exclude RSYNC.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RSYNC); } } void init_rsync_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("RSYNC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RSYNC, ndpi_search_rsync, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/rtcp.c000066400000000000000000000061751321103654100166510ustar00rootroot00000000000000/* * rtcp.c (RTP Control Protocol) * * Copyright (C) 2013 Remy Mudingay * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_RTCP static void ndpi_int_rtcp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTCP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_rtcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport = 0, sport = 0; NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "search for RTCP.\n"); if(packet->tcp != NULL) { sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest); NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "calculating dport over tcp.\n"); if(packet->payload_packet_len > 13 && (sport == 554 || dport == 554) && packet->payload[0] == 0x00 && packet->payload[1] == 0x00 && packet->payload[2] == 0x01 && packet->payload[3] == 0x01 && packet->payload[4] == 0x08 && packet->payload[5] == 0x0a && packet->payload[6] == 0x00 && packet->payload[7] == 0x01) { NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "found rtcp.\n"); ndpi_int_rtcp_add_connection(ndpi_struct, flow); } } else if(packet->udp != NULL) { /* Let's check first the RTCP packet length */ u_int16_t len, offset = 0, rtcp_section_len; while(offset + 3 < packet->payload_packet_len) { len = packet->payload[2+offset] * 256 + packet->payload[2+offset+1]; rtcp_section_len = (len + 1) * 4; if(((offset+rtcp_section_len) > packet->payload_packet_len) || (rtcp_section_len == 0)) goto exclude_rtcp; else offset += rtcp_section_len; } NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "calculating dport over udp.\n"); /* TODO changed a pair of length condition to the && from ||. Is it correct? */ if(((packet->payload_packet_len >= 28 && packet->payload_packet_len <= 1200) && ((packet->payload[0] == 0x80) && ((packet->payload[1] == 0xc8) || (packet->payload[1] == 0xc9)) && (packet->payload[2] == 0x00))) || (packet->payload_packet_len >= 3 && ((packet->payload[0] == 0x81) && ((packet->payload[1] == 0xc8) || (packet->payload[1] == 0xc9)) && (packet->payload[2] == 0x00)))) { NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "found rtcp.\n"); ndpi_int_rtcp_add_connection(ndpi_struct, flow); } } else { exclude_rtcp: NDPI_LOG(NDPI_PROTOCOL_RTCP, ndpi_struct, NDPI_LOG_DEBUG, "exclude RTCP.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTCP); } } void init_rtcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("RTCP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RTCP, ndpi_search_rtcp, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/rtmp.c000066400000000000000000000100731321103654100166530ustar00rootroot00000000000000/* * rtmp.c * * Copyright (C) 2014 Tomasz Bujlow * * The signature is based on the Libprotoident library. * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_RTMP static void ndpi_int_rtmp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTMP, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_rtmp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Break after 20 packets. */ if (flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_RTMP, ndpi_struct, NDPI_LOG_DEBUG, "Exclude RTMP.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTMP); return; } /* Check if we so far detected the protocol in the request or not. */ if (flow->rtmp_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_RTMP, ndpi_struct, NDPI_LOG_DEBUG, "RTMP stage 0: \n"); if ((payload_len >= 4) && ((packet->payload[0] == 0x03) || (packet->payload[0] == 0x06))) { NDPI_LOG(NDPI_PROTOCOL_RTMP, ndpi_struct, NDPI_LOG_DEBUG, "Possible RTMP request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->rtmp_stage = packet->packet_direction + 1; } } else { NDPI_LOG(NDPI_PROTOCOL_RTMP, ndpi_struct, NDPI_LOG_DEBUG, "RTMP stage %u: \n", flow->rtmp_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->rtmp_stage - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len >= 4) && ((packet->payload[0] == 0x03) || (packet->payload[0] == 0x06) || (packet->payload[0] == 0x08) || (packet->payload[0] == 0x09) || (packet->payload[0] == 0x0a))) { NDPI_LOG(NDPI_PROTOCOL_RTMP, ndpi_struct, NDPI_LOG_DEBUG, "Found RTMP.\n"); ndpi_int_rtmp_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_RTMP, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to RTMP, resetting the stage to 0...\n"); flow->rtmp_stage = 0; } } } void ndpi_search_rtmp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_RTMP, ndpi_struct, NDPI_LOG_DEBUG, "RTMP detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_RTMP) { if (packet->tcp_retransmission == 0) { ndpi_check_rtmp(ndpi_struct, flow); } } } void init_rtmp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("RTMP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RTMP, ndpi_search_rtmp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/rtp.c000066400000000000000000000360721321103654100165050ustar00rootroot00000000000000/* * rtp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_RTP /* http://www.myskypelab.com/2014/05/microsoft-lync-wireshark-plugin.html */ static u_int8_t isValidMSRTPType(u_int8_t payloadType) { switch(payloadType) { case 0: /* G.711 u-Law */ case 3: /* GSM 6.10 */ case 4: /* G.723.1 */ case 8: /* G.711 A-Law */ case 9: /* G.722 */ case 13: /* Comfort Noise */ case 96: /* Dynamic RTP */ case 97: /* Redundant Audio Data Payload */ case 101: /* DTMF */ case 103: /* SILK Narrowband */ case 104: /* SILK Wideband */ case 111: /* Siren */ case 112: /* G.722.1 */ case 114: /* RT Audio Wideband */ case 115: /* RT Audio Narrowband */ case 116: /* G.726 */ case 117: /* G.722 */ case 118: /* Comfort Noise Wideband */ case 34: /* H.263 [MS-H26XPF] */ case 121: /* RT Video */ case 122: /* H.264 [MS-H264PF] */ case 123: /* H.264 FEC [MS-H264PF] */ case 127: /* x-data */ return(1 /* RTP */); break; case 200: /* RTCP PACKET SENDER */ case 201: /* RTCP PACKET RECEIVER */ case 202: /* RTCP Source Description */ case 203: /* RTCP Bye */ return(2 /* RTCP */); break; default: return(0); } } static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const u_int8_t * payload, const u_int16_t payload_len) { if (payload_len < 2) return; //struct ndpi_packet_struct *packet = &flow->packet; u_int8_t payloadType, payload_type = payload[1] & 0x7F; u_int32_t *ssid = (u_int32_t*)&payload[8]; /* Check whether this is an RTP flow */ if((payload_len >= 12) && (((payload[0] & 0xFF) == 0x80) || ((payload[0] & 0xFF) == 0xA0)) /* RTP magic byte[1] */ && ((payload_type < 72) || (payload_type > 76)) && ((payload_type <= 34) || ((payload_type >= 96) && (payload_type <= 127)) /* http://www.iana.org/assignments/rtp-parameters/rtp-parameters.xhtml */ ) && (*ssid != 0) ) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "Found RTP.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTP, NDPI_PROTOCOL_UNKNOWN); return; } else if((payload_len >= 12) && (((payload[0] & 0xFF) == 0x80) || ((payload[0] & 0xFF) == 0xA0)) /* RTP magic byte[1] */ && (payloadType = isValidMSRTPType(payload[1] & 0xFF))) { if(payloadType == 1 /* RTP */) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "Found Skype for Business (former MS Lync)\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN); } else /* RTCP */ { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "Found MS RTCP\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTCP, NDPI_PROTOCOL_UNKNOWN); } } /* No luck this time */ NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude rtp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP); } void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* printf("*** %s(pkt=%d)\n", __FUNCTION__, flow->packet_counter); */ if((packet->udp != NULL) && (ntohs(packet->udp->source) > 1023) && (ntohs(packet->udp->dest) > 1023)) ndpi_rtp_search(ndpi_struct, flow, packet->payload, packet->payload_packet_len); } #if 0 /* Original (messy) OpenDPI code */ #define RTP_MAX_OUT_OF_ORDER 11 static void ndpi_int_rtp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTP, NDPI_PROTOCOL_UNKNOWN); } /* * maintenance of current highest sequence number, cycle count, packet counter * adapted from RFC3550 Appendix A.1 * * In their formulation, it is not possible to represent "no packets sent yet". This is fixed here by defining * baseseq to be the sequence number of the first packet minus 1 (in other words, the sequence number of the * zeroth packet). * * Note: As described in the RFC, the number of packets received includes retransmitted packets. * This means the "packets lost" count (seq_num-isn+1)-received can become negative. * * include_current_packet should be * 1, if the current packet should count towards the total, or * 0, if it it regarded as belonging to the previous reporting interval */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif void init_seq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t direction, u_int16_t seq, u_int8_t include_current_packet) { flow->rtp_seqnum[direction] = seq; NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "rtp_seqnum[%u] = %u\n", direction, seq); } /* returns difference between old and new highest sequence number */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int16_t update_seq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t direction, u_int16_t seq) { u_int16_t delta = seq - flow->rtp_seqnum[direction]; if (delta < RTP_MAX_OUT_OF_ORDER) { /* in order, with permissible gap */ flow->rtp_seqnum[direction] = seq; NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "rtp_seqnum[%u] = %u (increased by %u)\n", direction, seq, delta); return delta; } else { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "retransmission (dir %u, seqnum %u)\n", direction, seq); return 0; } } static void ndpi_rtp_search(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const u_int8_t * payload, const u_int16_t payload_len) { struct ndpi_packet_struct *packet = &flow->packet; u_int8_t stage; u_int16_t seqnum = ntohs(get_u_int16_t(payload, 2)); NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "search rtp.\n"); if (payload_len == 4 && get_u_int32_t(packet->payload, 0) == 0 && flow->packet_counter < 8) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "need next packet, maybe ClearSea out calls.\n"); return; } if (payload_len == 5 && memcmp(payload, "hello", 5) == 0) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "need next packet, initial hello packet of SIP out calls.\n"); return; } if (payload_len == 1 && payload[0] == 0) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "need next packet, payload_packet_len == 1 && payload[0] == 0.\n"); return; } if (payload_len == 3 && memcmp(payload, "png", 3) == 0) { /* weird packet found in Ninja GlobalIP trace */ NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "skipping packet with len = 3 and png payload.\n"); return; } if (payload_len < 12) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "minimal packet size for rtp packets: 12.\n"); goto exclude_rtp; } if (payload_len == 12 && get_u_int32_t(payload, 0) == 0 && get_u_int32_t(payload, 4) == 0 && get_u_int32_t(payload, 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "skipping packet with len = 12 and only 0-bytes.\n"); return; } if ((payload[0] & 0xc0) == 0xc0 || (payload[0] & 0xc0) == 0x40 || (payload[0] & 0xc0) == 0x00) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "version = 3 || 1 || 0, maybe first rtp packet.\n"); return; } if ((payload[0] & 0xc0) != 0x80) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "rtp version must be 2, first two bits of a packets must be 10.\n"); goto exclude_rtp; } /* rtp_payload_type are the last seven bits of the second byte */ if (flow->rtp_payload_type[packet->packet_direction] != (payload[1] & 0x7F)) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "payload_type has changed, reset stages.\n"); packet->packet_direction == 0 ? (flow->rtp_stage1 = 0) : (flow->rtp_stage2 = 0); } /* first bit of first byte is not part of payload_type */ flow->rtp_payload_type[packet->packet_direction] = payload[1] & 0x7F; stage = (packet->packet_direction == 0 ? flow->rtp_stage1 : flow->rtp_stage2); if (stage > 0) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "stage = %u.\n", packet->packet_direction == 0 ? flow->rtp_stage1 : flow->rtp_stage2); if (flow->rtp_ssid[packet->packet_direction] != get_u_int32_t(payload, 8)) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "ssid has changed, goto exclude rtp.\n"); goto exclude_rtp; } if (seqnum == flow->rtp_seqnum[packet->packet_direction]) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "maybe \"retransmission\", need next packet.\n"); return; } else if ((u_int16_t) (seqnum - flow->rtp_seqnum[packet->packet_direction]) < RTP_MAX_OUT_OF_ORDER) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "new packet has larger sequence number (within valid range)\n"); update_seq(ndpi_struct, flow, packet->packet_direction, seqnum); } else if ((u_int16_t) (flow->rtp_seqnum[packet->packet_direction] - seqnum) < RTP_MAX_OUT_OF_ORDER) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "new packet has smaller sequence number (within valid range)\n"); init_seq(ndpi_struct, flow, packet->packet_direction, seqnum, 1); } else { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "sequence number diff is too big, goto exclude rtp.\n"); goto exclude_rtp; } } else { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "rtp_ssid[%u] = %u.\n", packet->packet_direction, flow->rtp_ssid[packet->packet_direction]); flow->rtp_ssid[packet->packet_direction] = get_u_int32_t(payload, 8); if (flow->packet_counter < 3) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "packet_counter < 3, need next packet.\n"); } init_seq(ndpi_struct, flow, packet->packet_direction, seqnum, 1); } if (seqnum <= 3) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "sequence_number = %u, too small, need next packet, return.\n", seqnum); return; } if (stage == 3) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "add connection I.\n"); ndpi_int_rtp_add_connection(ndpi_struct, flow); } else { packet->packet_direction == 0 ? flow->rtp_stage1++ : flow->rtp_stage2++; NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "stage[%u]++; need next packet.\n", packet->packet_direction); } return; exclude_rtp: #ifdef NDPI_PROTOCOL_STUN if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN || /* packet->real_protocol_read_only == NDPI_PROTOCOL_STUN */) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "STUN: is detected, need next packet.\n"); return; } #endif /* NDPI_PROTOCOL_STUN */ NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude rtp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP); } void ndpi_search_rtp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->udp) { ndpi_rtp_search(ndpi_struct, flow, packet->payload, packet->payload_packet_len); } else if (packet->tcp) { /* skip special packets seen at yahoo traces */ if (packet->payload_packet_len >= 20 && ntohs(get_u_int16_t(packet->payload, 2)) + 20 == packet->payload_packet_len && packet->payload[0] == 0x90 && packet->payload[1] >= 0x01 && packet->payload[1] <= 0x07) { if (flow->packet_counter == 2) flow->l4.tcp.rtp_special_packets_seen = 1; NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "skipping STUN-like, special yahoo packets with payload[0] == 0x90.\n"); return; } #ifdef NDPI_PROTOCOL_STUN /* TODO the rtp detection sometimes doesn't exclude rtp * so for TCP flows only run the detection if STUN has been * detected (or RTP is already detected) * If flows will be seen which start directly with RTP * we can remove this restriction */ if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_RTP) { /* RTP may be encapsulated in TCP packets */ if (packet->payload_packet_len >= 2 && ntohs(get_u_int16_t(packet->payload, 0)) + 2 == packet->payload_packet_len) { /* TODO there could be several RTP packets in a single TCP packet so maybe the detection could be * improved by checking only the RTP packet of given length */ ndpi_rtp_search(ndpi_struct, flow, packet->payload + 2, packet->payload_packet_len - 2); return; } } if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && flow->l4.tcp.rtp_special_packets_seen == 1) { if (packet->payload_packet_len >= 4 && ntohl(get_u_int32_t(packet->payload, 0)) + 4 == packet->payload_packet_len) { /* TODO there could be several RTP packets in a single TCP packet so maybe the detection could be * improved by checking only the RTP packet of given length */ ndpi_rtp_search(ndpi_struct, flow, packet->payload + 4, packet->payload_packet_len - 4); return; } } if (NDPI_FLOW_PROTOCOL_EXCLUDED(ndpi_struct, flow, NDPI_PROTOCOL_STUN)) { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude rtp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP); } else { NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "STUN not yet excluded, need next packet.\n"); } #else NDPI_LOG(NDPI_PROTOCOL_RTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude rtp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP); #endif } } #endif void init_rtp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("RTP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RTP, ndpi_search_rtp, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif /* NDPI_PROTOCOL_RTP */ nDPI-2.2/src/lib/protocols/rtsp.c000066400000000000000000000111541321103654100166620ustar00rootroot00000000000000/* * rtsp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_RTSP #ifndef NDPI_PROTOCOL_RTP #error RTSP requires RTP detection to work correctly #endif #ifndef NDPI_PROTOCOL_RTSP #error RTSP requires RTSP detection to work correctly #endif #ifndef NDPI_PROTOCOL_RDP #error RTSP requires RDP detection to work correctly #endif static void ndpi_int_rtsp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RTSP, NDPI_PROTOCOL_UNKNOWN); } /* this function searches for a rtsp-"handshake" over tcp or udp. */ void ndpi_search_rtsp_tcp_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_TRACE, "RTSP detection...\n"); if (flow->rtsprdt_stage == 0 #ifdef NDPI_PROTOCOL_RTCP && !(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_RTCP) #endif ) { flow->rtsprdt_stage = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_DEBUG, "maybe handshake 1; need next packet, return.\n"); return; } if (flow->packet_counter < 3 && flow->rtsprdt_stage == 1 + packet->packet_direction) { NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_DEBUG, "maybe handshake 2; need next packet.\n"); return; } if (packet->payload_packet_len > 20 && flow->rtsprdt_stage == 2 - packet->packet_direction) { char buf[32] = { 0 }; u_int len = packet->payload_packet_len; if(len >= (sizeof(buf)-1)) len = sizeof(buf)-1; strncpy(buf, (const char*)packet->payload, len); // RTSP Server Message if((memcmp(packet->payload, "RTSP/1.0 ", 9) == 0) || (strstr(buf, "rtsp://") != NULL)) { NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_TRACE, "found RTSP/1.0 .\n"); if (dst != NULL) { NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_TRACE, "found dst.\n"); ndpi_packet_src_ip_get(packet, &dst->rtsp_ip_address); dst->rtsp_timer = packet->tick_timestamp; dst->rtsp_ts_set = 1; } if (src != NULL) { NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_TRACE, "found src.\n"); ndpi_packet_dst_ip_get(packet, &src->rtsp_ip_address); src->rtsp_timer = packet->tick_timestamp; src->rtsp_ts_set = 1; } NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_TRACE, "RTSP detected.\n"); flow->rtsp_control_flow = 1; ndpi_int_rtsp_add_connection(ndpi_struct, flow); return; } } if (packet->udp != NULL && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && ((NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP) == 0) #ifdef NDPI_PROTOCOL_RTCP || (NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTCP) == 0) #endif )) { NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_DEBUG, "maybe RTSP RTP, RTSP RTCP, RDT; need next packet.\n"); return; } NDPI_LOG(NDPI_PROTOCOL_RTSP, ndpi_struct, NDPI_LOG_DEBUG, "didn't find handshake, exclude.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTSP); return; } void init_rtsp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("RTSP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RTSP, ndpi_search_rtsp_tcp_udp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/rx.c000066400000000000000000000165141321103654100163300ustar00rootroot00000000000000/* * rx.c * * Copyright (C) 2012-16 - ntop.org * * Giovanni Mascellani * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_RX /* See http://web.mit.edu/kolya/afs/rx/rx-spec for protocol description. */ /* The should be no need for explicit packing, but just in case... */ PACK_ON struct ndpi_rx_header { u_int32_t conn_epoch; u_int32_t conn_id; u_int32_t call_number; u_int32_t sequence_number; u_int32_t serial_number; u_int8_t type; u_int8_t flags; u_int8_t status; u_int8_t security; u_int16_t checksum; u_int16_t service_id; } PACK_OFF; /* Type values */ #define DATA 1 #define ACK 2 #define BUSY 3 #define ABORT 4 #define ACKALL 5 #define CHALLENGE 6 #define RESPONSE 7 #define DEBUG 8 #define PARAM_1 9 #define PARAM_2 10 #define PARAM_3 11 #define PARAMS_4 12 #define VERSION 13 /* Flags values */ #define EMPTY 0 #define CLIENT_INIT_1 1 #define REQ_ACK 2 #define PLUS_0 3 #define LAST_PKT 4 #define PLUS_1 5 #define PLUS_2 6 #define MORE_1 9 #define CLIENT_INIT_2 33 void ndpi_check_rx(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "RX: pck: %d, dir[0]: %d, dir[1]: %d\n", flow->packet_counter, flow->packet_direction_counter[0], flow->packet_direction_counter[1]); /* Check that packet is long enough */ if (payload_len < sizeof(struct ndpi_rx_header)) { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; } struct ndpi_rx_header *header = (struct ndpi_rx_header*) packet->payload; /** * Useless check: a session could be detected also after it starts * and this check limit the correct detection for -d option (disable guess) * TODO - maybe to improve **/ /* Check whether the packet has counters beginning from one; the Sequence Number can be zero if the packet is just an ACK. */ /* if ((ntohl(header->sequence_number) | 1) != 1 || ntohl(header->serial_number) != 1) */ /** * Check the TYPE and FLAGS fields of an RX packet header. * This check is necessary because we could detect an RX session already begun **/ /* TYPE field */ if((header->type < DATA) || (header->type > VERSION)) { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; } /* FLAGS fields */ if(header->flags == EMPTY || header->flags == LAST_PKT || header->flags == PLUS_0 || header->flags == PLUS_1 || header->flags == PLUS_2 || header->flags == REQ_ACK || header->flags == MORE_1 || header->flags == CLIENT_INIT_1 || header->flags == CLIENT_INIT_2) { /* TYPE and FLAGS combo */ switch(header->type) { case DATA: if(header->flags == LAST_PKT || header->flags == EMPTY || header->flags == PLUS_0 || header->flags == PLUS_1 || header->flags == PLUS_2 || header->flags == REQ_ACK || header->flags == MORE_1) goto security; case ACK: if(header->flags == CLIENT_INIT_1 || header->flags == CLIENT_INIT_2 || header->flags == EMPTY) goto security; case CHALLENGE: if(header->flags == EMPTY || header->call_number == 0) goto security; case RESPONSE: if(header->flags == EMPTY || header->call_number == 0) goto security; case ACKALL: if(header->flags == EMPTY) goto security; case BUSY: goto security; case ABORT: goto security; case DEBUG: goto security; case PARAM_1: goto security; case PARAM_2: goto security; case PARAM_3: goto security; case VERSION: goto security; default: NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; } // switch } else { // FLAG NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; } security: /* SECURITY field */ if(header->security > 3) { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; } /* If we have already seen one packet in the other direction, then the two must have matching connection numbers. Otherwise store them. */ if(flow->packet_direction_counter[!packet->packet_direction] != 0) { if (flow->l4.udp.rx_conn_epoch == header->conn_epoch && flow->l4.udp.rx_conn_id == header->conn_id) { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "found RX\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RX, NDPI_PROTOCOL_UNKNOWN); } /* https://www.central.org/frameless/numbers/rxservice.html. */ else { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "excluding RX\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RX); return; } } else { flow->l4.udp.rx_conn_epoch = header->conn_epoch; flow->l4.udp.rx_conn_id = header->conn_id; { NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "found RX\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_RX, NDPI_PROTOCOL_UNKNOWN); } } } void ndpi_search_rx(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_RX, ndpi_struct, NDPI_LOG_DEBUG, "entering RX search\n"); if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_RX) { ndpi_check_rx(ndpi_struct, flow); } } void init_rx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("RX", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_RX, ndpi_search_rx, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/sflow.c000066400000000000000000000041411321103654100170220ustar00rootroot00000000000000/* * sflow.c * * Copyright (C) 2011-15 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_SFLOW static void ndpi_check_sflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if((packet->udp != NULL) && (payload_len >= 24) /* Version */ && (packet->payload[0] == 0) && (packet->payload[1] == 0) && (packet->payload[2] == 0) && ((packet->payload[3] == 2) || (packet->payload[3] == 5))) { NDPI_LOG(NDPI_PROTOCOL_SFLOW, ndpi_struct, NDPI_LOG_DEBUG, "Found sflow.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SFLOW, NDPI_PROTOCOL_UNKNOWN); return; } } void ndpi_search_sflow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { NDPI_LOG(NDPI_PROTOCOL_SFLOW, ndpi_struct, NDPI_LOG_DEBUG, "sflow detection...\n"); ndpi_check_sflow(ndpi_struct, flow); } void init_sflow_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("sFlow", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SFLOW, ndpi_search_sflow, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/shoutcast.c000066400000000000000000000110401321103654100177010ustar00rootroot00000000000000/* * shoutcast.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SHOUTCAST static void ndpi_int_shoutcast_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SHOUTCAST, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_shoutcast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "search shoutcast.\n"); if (flow->packet_counter == 1) { /* this case in paul_upload_oddcast_002.pcap */ if (packet->payload_packet_len >= 6 && packet->payload_packet_len < 80 && memcmp(packet->payload, "123456", 6) == 0) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "Shoutcast stage 1, \"123456\".\n"); return; } if (flow->packet_counter < 3 #ifdef NDPI_PROTOCOL_HTTP && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP #endif ) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "http detected, need next packet for shoutcast detection.\n"); if (packet->payload_packet_len > 4 && get_u_int32_t(packet->payload, packet->payload_packet_len - 4) != htonl(0x0d0a0d0a)) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "segmented packet found.\n"); flow->l4.tcp.shoutcast_stage = 1 + packet->packet_direction; } return; } /* else goto exclude_shoutcast; */ } /* evtl. für asym detection noch User-Agent:Winamp dazunehmen. */ if (packet->payload_packet_len > 11 && memcmp(packet->payload, "ICY 200 OK\x0d\x0a", 12) == 0) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "found shoutcast by ICY 200 OK.\n"); ndpi_int_shoutcast_add_connection(ndpi_struct, flow); return; } if (flow->l4.tcp.shoutcast_stage == 1 + packet->packet_direction && flow->packet_direction_counter[packet->packet_direction] < 5) { return; } if (flow->packet_counter == 2) { if (packet->payload_packet_len == 2 && memcmp(packet->payload, "\x0d\x0a", 2) == 0) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "Shoutcast stage 1 continuation.\n"); return; } else if (packet->payload_packet_len > 3 && memcmp(&packet->payload[0], "OK2", 3) == 0) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "Shoutcast stage 2, OK2 found.\n"); return; } else goto exclude_shoutcast; } else if (flow->packet_counter == 3 || flow->packet_counter == 4) { if (packet->payload_packet_len > 3 && memcmp(&packet->payload[0], "OK2", 3) == 0) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "Shoutcast stage 2, OK2 found.\n"); return; } else if (packet->payload_packet_len > 4 && memcmp(&packet->payload[0], "icy-", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "Shoutcast detected.\n"); ndpi_int_shoutcast_add_connection(ndpi_struct, flow); return; } else goto exclude_shoutcast; } exclude_shoutcast: NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SHOUTCAST); NDPI_LOG(NDPI_PROTOCOL_SHOUTCAST, ndpi_struct, NDPI_LOG_DEBUG, "Shoutcast excluded.\n"); } void init_shoutcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("ShoutCast", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SHOUTCAST, ndpi_search_shoutcast_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/sip.c000066400000000000000000000176471321103654100165020ustar00rootroot00000000000000/* * sip.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_SIP static void ndpi_int_sip_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t due_to_correlation) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SIP, NDPI_PROTOCOL_UNKNOWN); } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif void ndpi_search_sip_handshake(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if (payload_len > 4) { /* search for STUN Turn ChannelData Prefix */ u_int16_t message_len = ntohs(get_u_int16_t(packet->payload, 2)); if (payload_len - 4 == message_len) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found STUN TURN ChannelData prefix.\n"); payload_len -= 4; packet_payload += 4; } } #ifndef NDPI_PROTOCOL_YAHOO if (payload_len >= 14 && packet_payload[payload_len - 2] == 0x0d && packet_payload[payload_len - 1] == 0x0a) #endif #ifdef NDPI_PROTOCOL_YAHOO if (payload_len >= 14) #endif { if ((memcmp(packet_payload, "NOTIFY ", 7) == 0 || memcmp(packet_payload, "notify ", 7) == 0) && (memcmp(&packet_payload[7], "SIP:", 4) == 0 || memcmp(&packet_payload[7], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip NOTIFY.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } if ((memcmp(packet_payload, "REGISTER ", 9) == 0 || memcmp(packet_payload, "register ", 9) == 0) && (memcmp(&packet_payload[9], "SIP:", 4) == 0 || memcmp(&packet_payload[9], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip REGISTER.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } if ((memcmp(packet_payload, "INVITE ", 7) == 0 || memcmp(packet_payload, "invite ", 7) == 0) && (memcmp(&packet_payload[7], "SIP:", 4) == 0 || memcmp(&packet_payload[7], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip INVITE.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } /* seen this in second direction on the third position, * maybe it could be deleted, if somebody sees it in the first direction, * please delete this comment. */ /* if (memcmp(packet_payload, "SIP/2.0 200 OK", 14) == 0 || memcmp(packet_payload, "sip/2.0 200 OK", 14) == 0) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip SIP/2.0 0K.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } */ if (memcmp(packet_payload, "SIP/2.0 ", 8) == 0 || memcmp(packet_payload, "sip/2.0 ", 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip SIP/2.0 *.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } if ((memcmp(packet_payload, "BYE ", 4) == 0 || memcmp(packet_payload, "bye ", 4) == 0) && (memcmp(&packet_payload[4], "SIP:", 4) == 0 || memcmp(&packet_payload[4], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip BYE.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } if ((memcmp(packet_payload, "ACK ", 4) == 0 || memcmp(packet_payload, "ack ", 4) == 0) && (memcmp(&packet_payload[4], "SIP:", 4) == 0 || memcmp(&packet_payload[4], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip ACK.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } if ((memcmp(packet_payload, "CANCEL ", 7) == 0 || memcmp(packet_payload, "cancel ", 7) == 0) && (memcmp(&packet_payload[7], "SIP:", 4) == 0 || memcmp(&packet_payload[7], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip CANCEL.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } /* Courtesy of Miguel Quesada */ if ((memcmp(packet_payload, "OPTIONS ", 8) == 0 || memcmp(packet_payload, "options ", 8) == 0) && (memcmp(&packet_payload[8], "SIP:", 4) == 0 || memcmp(&packet_payload[8], "sip:", 4) == 0)) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "found sip OPTIONS.\n"); ndpi_int_sip_add_connection(ndpi_struct, flow, 0); return; } } /* add bitmask for tcp only, some stupid udp programs * send a very few (< 10 ) packets before invite (mostly a 0x0a0x0d, but just search the first 3 payload_packets here */ if (packet->udp != NULL && flow->packet_counter < 20) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "need next packet.\n"); return; } #ifdef NDPI_PROTOCOL_STUN /* for STUN flows we need some more packets */ if (packet->udp != NULL && flow->detected_protocol_stack[0] == NDPI_PROTOCOL_STUN && flow->packet_counter < 40) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "need next STUN packet.\n"); return; } #endif if (payload_len == 4 && get_u_int32_t(packet_payload, 0) == 0) { NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "maybe sip. need next packet.\n"); return; } #ifdef NDPI_PROTOCOL_YAHOO if (payload_len > 30 && packet_payload[0] == 0x90 && packet_payload[3] == payload_len - 20 && get_u_int32_t(packet_payload, 4) == 0 && get_u_int32_t(packet_payload, 8) == 0) { flow->sip_yahoo_voice = 1; NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "maybe sip yahoo. need next packet.\n"); } if (flow->sip_yahoo_voice && flow->packet_counter < 10) { return; } #endif NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "exclude sip.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SIP); return; } void ndpi_search_sip(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_flow_struct *flow = ndpi_struct->flow; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_SIP, ndpi_struct, NDPI_LOG_DEBUG, "sip detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_SIP) { if (packet->tcp_retransmission == 0) { ndpi_search_sip_handshake(ndpi_struct, flow); } } } void init_sip_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SIP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SIP, ndpi_search_sip, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD,/* Fix courtesy of Miguel Quesada */ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/skinny.c000066400000000000000000000063271321103654100172130ustar00rootroot00000000000000/* * skinny.c * * Copyright (C) 2013 Remy Mudingay * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_SKINNY static void ndpi_int_skinny_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKINNY, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_skinny(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport = 0, sport = 0; const char pattern_9_bytes[9] = { 0x24, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; const char pattern_8_bytes[8] = { 0x38, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; const char keypadmsg_8_bytes[8] = { 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; const char selectmsg_8_bytes[8] = { 0x14, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; NDPI_LOG(NDPI_PROTOCOL_SKINNY, ndpi_struct, NDPI_LOG_DEBUG, "search for SKINNY.\n"); if(packet->tcp != NULL) { sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest); NDPI_LOG(NDPI_PROTOCOL_SKINNY, ndpi_struct, NDPI_LOG_DEBUG, "calculating SKINNY over tcp.\n"); if (dport == 2000 && ((packet->payload_packet_len == 24 && memcmp(&packet->payload[0], keypadmsg_8_bytes, 8) == 0) || ((packet->payload_packet_len == 64) && memcmp(&packet->payload[0], pattern_8_bytes, 8) == 0))) { NDPI_LOG(NDPI_PROTOCOL_SKINNY, ndpi_struct, NDPI_LOG_DEBUG, "found skinny.\n"); ndpi_int_skinny_add_connection(ndpi_struct, flow); } else if (sport == 2000 && ((packet->payload_packet_len == 28 && memcmp(&packet->payload[0], selectmsg_8_bytes, 8) == 0 ) || (packet->payload_packet_len == 44 && memcmp(&packet->payload[0], pattern_9_bytes, 9) == 0))) { NDPI_LOG(NDPI_PROTOCOL_SKINNY, ndpi_struct, NDPI_LOG_DEBUG, "found skinny.\n"); ndpi_int_skinny_add_connection(ndpi_struct, flow); } } else { NDPI_LOG(NDPI_PROTOCOL_SKINNY, ndpi_struct, NDPI_LOG_DEBUG, "exclude SKINNY.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SKINNY); } } void init_skinny_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("CiscoSkinny", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SKINNY, ndpi_search_skinny, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/skype.c000066400000000000000000000072341321103654100170310ustar00rootroot00000000000000/* * skype.c * * Copyright (C) 2017 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_SKYPE static void ndpi_check_skype(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if(flow->host_server_name[0] != '\0') return; // UDP check if(packet->udp != NULL) { flow->l4.udp.skype_packet_id++; if(flow->l4.udp.skype_packet_id < 5) { u_int16_t dport = ntohs(packet->udp->dest); /* skype-to-skype */ if(dport != 1119) /* It can be confused with battle.net */ { if(((payload_len == 3) && ((packet->payload[2] & 0x0F)== 0x0d)) || ((payload_len >= 16) && (packet->payload[0] != 0x30) /* Avoid invalid SNMP detection */ && (packet->payload[2] == 0x02))) { NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found skype.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN); } } return; } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SKYPE); return; // TCP check } else if(packet->tcp != NULL) { flow->l4.tcp.skype_packet_id++; if(flow->l4.tcp.skype_packet_id < 3) { ; /* Too early */ } else if((flow->l4.tcp.skype_packet_id == 3) /* We have seen the 3-way handshake */ && flow->l4.tcp.seen_syn && flow->l4.tcp.seen_syn_ack && flow->l4.tcp.seen_ack) { if((payload_len == 8) || (payload_len == 3) || (payload_len == 17)) { // printf("[SKYPE] payload_len=%u\n", payload_len); /* printf("[SKYPE] %u/%u\n", ntohs(packet->tcp->source), ntohs(packet->tcp->dest)); */ NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found skype.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SKYPE, NDPI_PROTOCOL_UNKNOWN); } else { // printf("NO [SKYPE] payload_len=%u\n", payload_len); } /* printf("[SKYPE] [id: %u][len: %d]\n", flow->l4.tcp.skype_packet_id, payload_len); */ } else NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SKYPE); return; } } void ndpi_search_skype(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "skype detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_SKYPE) ndpi_check_skype(ndpi_struct, flow); } void init_skype_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Skype", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SKYPE, ndpi_search_skype, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/smb.c000066400000000000000000000043541321103654100164570ustar00rootroot00000000000000/* * smb.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SMB void ndpi_search_smb_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* Check connection over TCP */ if(packet->tcp) { NDPI_LOG(NDPI_PROTOCOL_SMB, ndpi_struct, NDPI_LOG_DEBUG, "search SMB.\n"); if(packet->tcp->dest == htons(445) && packet->payload_packet_len > (32 + 4 + 4) && (packet->payload_packet_len - 4) == ntohl(get_u_int32_t(packet->payload, 0)) && get_u_int32_t(packet->payload, 4) == htonl(0xff534d42)) { NDPI_LOG(NDPI_PROTOCOL_SMB, ndpi_struct, NDPI_LOG_DEBUG, "found SMB.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SMB, NDPI_PROTOCOL_UNKNOWN); return; } } NDPI_LOG(NDPI_PROTOCOL_SMB, ndpi_struct, NDPI_LOG_DEBUG, "exclude SMB.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SMB); } void init_smb_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SMB", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SMB, ndpi_search_smb_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/smpp.c000066400000000000000000000232171321103654100166540ustar00rootroot00000000000000/* * smpp.c * * Copyright (C) 2016 - Damir Franusic * Copyright (C) 2016 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SMPP static void ndpi_int_smpp_add_connection(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SMPP, NDPI_PROTOCOL_UNKNOWN); } static u_int8_t ndpi_check_overflow(u_int32_t current_length, u_int32_t total_lenth) { return (current_length > 0 && current_length > INT_MAX - total_lenth); } void ndpi_search_smpp_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "SMPP protocol detection...\n"); if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_SMPP){ struct ndpi_packet_struct* packet = &flow->packet; // min SMPP packet length = 16 bytes if (packet->payload_packet_len < 16) { NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "SMPP excluded\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SMPP); return; } // get PDU length u_int32_t pdu_l = ntohl(get_u_int32_t(packet->payload, 0)); NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "calculated PDU Length: %d, received PDU Length: %d\n", pdu_l, packet->payload_packet_len); // if PDU size was invalid, try the following TCP segments, 3 attempts max if(flow->packet_counter > 3) { NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "SMPP excluded\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SMPP); return; } // verify PDU length if(pdu_l != packet->payload_packet_len) { // check if multiple PDUs included u_int32_t total_pdu_l = pdu_l; u_int32_t tmp_pdu_l = 0; u_int16_t pdu_c = 1; // loop PDUs (check if lengths are valid) while(total_pdu_l < packet->payload_packet_len) { // get next PDU length tmp_pdu_l = ntohl(get_u_int32_t(packet->payload, total_pdu_l)); // if zero or overflowing , return, will try the next TCP segment if(tmp_pdu_l == 0 || ndpi_check_overflow(tmp_pdu_l, total_pdu_l) ) return; // inc total PDU length total_pdu_l += ntohl(get_u_int32_t(packet->payload, total_pdu_l)); // inc total PDU count ++pdu_c; } NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "multiple PDUs included, calculated total PDU Length: %d, PDU count: %d, TCP payload length: %d\n", total_pdu_l, pdu_c, packet->payload_packet_len); // verify multi PDU total length if(total_pdu_l != packet->payload_packet_len){ // return, will try the next TCP segment return; } } // *** check PDU type *** u_int32_t pdu_type = ntohl(get_u_int32_t(packet->payload, 4)); // first byte of PDU type is either 0x00 of 0x80 if(!(packet->payload[4] == 0x00 || packet->payload[4] == 0x80)) { NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "SMPP excluded\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SMPP); return; } // remove 0x80, get request type pdu u_int32_t pdu_req = pdu_type & 0x00FFFFFF; // list of known PDU types if((pdu_req > 0x00000000 && pdu_req <= 0x00000009) || (pdu_req == 0x0000000B || pdu_req == 0x00000015 || pdu_req == 0x00000021 || pdu_req == 0x00000102 || pdu_req == 0x00000103)){ NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "PDU type: %x, Request PDU type = %x\n", pdu_type, pdu_req); // fresult flag char extra_passed = 1; // check PDU type specifics switch(pdu_type){ // GENERIC_NACK case 0x80000000: // body length must be zero if(pdu_l > 16) extra_passed = 0; break; // BIND_RECEIVER // BIND_TRANSMITTER // BIND_TRANSCEIVER case 0x00000001: case 0x00000002: case 0x00000009: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 10 bytes (+16 in header) if(pdu_l < 26) extra_passed = 0; break; // BIND_RECEIVER_RESP // BIND_TRANSMITTER_RESP // BIND_TRANSCEIVER_RESP case 0x80000001: case 0x80000002: case 0x80000009: // min body length = 2 bytes (+16 in header) if(pdu_l < 18) extra_passed = 0; break; // OUTBIND case 0x0000000B: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 4 bytes (+16 in header) if(pdu_l < 20) extra_passed = 0; break; // UNBIND case 0x00000006: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // body length must be zero if(pdu_l > 16) extra_passed = 0; break; // UNBIND_RESP case 0x80000006: // body length must be zero if(pdu_l > 16) extra_passed = 0; break; // SUBMIT_SM case 0x00000004: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 17 bytes (+16 in header) if(pdu_l < 33) extra_passed = 0; break; // SUBMIT_SM_RESP case 0x80000004: // - if status != 0, body length is 2 bytes min // - if status > 0, body lenth must be zero if(get_u_int32_t(packet->payload, 8) != 0){ if(pdu_l > 16) extra_passed = 0; }else if(pdu_l < 18) extra_passed = 0; break; // SUBMIT_MULTI case 0x00000021: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 17 bytes (+16 in header) if(pdu_l < 33) extra_passed = 0; break; // SUBMIT_MULTI_RESP case 0x80000021: // min body length = 10 bytes (+16 in header) if(pdu_l < 26) extra_passed = 0; break; // DELIVER_SM case 0x00000005: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 17 bytes (+16 in header) if(pdu_l < 33) extra_passed = 0; break; // DELIVER_SM_RESP case 0x80000005: // min body length = 1 byte (+16 in header) if(pdu_l < 17) extra_passed = 0; break; // DATA_SM case 0x00000103: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 10 bytes (+16 in header) if(pdu_l < 26) extra_passed = 0; break; // DATA_SM_RESP case 0x80000103: // min body length = 2 bytes (+16 in header) if(pdu_l < 18) extra_passed = 0; break; // QUERY_SM case 0x00000003: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 4 bytes (+16 in header) if(pdu_l < 20) extra_passed = 0; break; // QUERY_SM_RESP case 0x80000003: // min body length = 5 bytes (+16 in header) if(pdu_l < 21) extra_passed = 0; break; // CANCEL_SM case 0x00000008: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 8 bytes (+16 in header) if(pdu_l < 24) extra_passed = 0; break; // CANCEL_SM_RESP case 0x80000008: // body lenth must be zero if(pdu_l > 16) extra_passed = 0; break; // REPLACE_SM case 0x00000007: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 9 bytes (+16 in header) if(pdu_l < 25) extra_passed = 0; break; // REPLACE_SM_RESP case 0x80000007: // body lenth must be zero if(pdu_l > 16) extra_passed = 0; break; // ENQUIRE_LINK case 0x00000015: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // body length must be zero if(pdu_l > 16) extra_passed = 0; break; // ENQUIRE_LINK_RESP case 0x80000015: // body length must be zero if(pdu_l > 16) extra_passed = 0; break; // ALERT_NOTIFICATION case 0x00000102: // status field must be NULL if(get_u_int32_t(packet->payload, 8) != 0) extra_passed = 0; // min body length = 6 bytes (+16 in header) if(pdu_l < 22) extra_passed = 0; break; default: break; } // if extra checks passed, set as identified if(extra_passed) { NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "SMPP identified...\n"); ndpi_int_smpp_add_connection(ndpi_struct, flow); return; } } // exclude NDPI_LOG(NDPI_PROTOCOL_SMPP, ndpi_struct, NDPI_LOG_DEBUG, "SMPP excluded\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SMPP); } } void init_smpp_dissector(struct ndpi_detection_module_struct* ndpi_struct, u_int32_t* id, NDPI_PROTOCOL_BITMASK* detection_bitmask) { ndpi_set_bitmask_protocol_detection("SMPP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SMPP, ndpi_search_smpp_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif // NDPI_PROTOCOL_SMPP nDPI-2.2/src/lib/protocols/snmp.c000066400000000000000000000120651321103654100166510ustar00rootroot00000000000000/* * snmp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SNMP static void ndpi_int_snmp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SNMP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_snmp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len > 32 && packet->payload[0] == 0x30) { int offset; u_int16_t u16; switch (packet->payload[1]) { case 0x81: offset = 3; break; case 0x82: offset = 4; break; default: if (packet->payload[1] > 0x82) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP excluded, second byte is > 0x82\n"); goto excl; } offset = 2; } u16 = ntohs(get_u_int16_t(packet->payload, offset)); if((u16 != 0x0201) && (u16 != 0x0204)) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP excluded, 0x0201/0x0204 pattern not found\n"); goto excl; } if (packet->payload[offset + 2] >= 0x04) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP excluded, version > 3\n"); goto excl; } if (flow->l4.udp.snmp_stage == 0) { if (packet->udp->dest == htons(161) || packet->udp->dest == htons(162)) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP detected due to port.\n"); ndpi_int_snmp_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP stage 0.\n"); if (packet->payload[offset + 2] == 3) { flow->l4.udp.snmp_msg_id = ntohs(get_u_int32_t(packet->payload, offset + 8)); } else if (packet->payload[offset + 2] == 0) { flow->l4.udp.snmp_msg_id = get_u_int8_t(packet->payload, offset + 15); } else { flow->l4.udp.snmp_msg_id = ntohs(get_u_int16_t(packet->payload, offset + 15)); } flow->l4.udp.snmp_stage = 1 + packet->packet_direction; return; } else if (flow->l4.udp.snmp_stage == 1 + packet->packet_direction) { if (packet->payload[offset + 2] == 0) { if (flow->l4.udp.snmp_msg_id != get_u_int8_t(packet->payload, offset + 15) - 1) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP v1 excluded, message ID doesn't match\n"); goto excl; } } } else if (flow->l4.udp.snmp_stage == 2 - packet->packet_direction) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP stage 1-2.\n"); if (packet->payload[offset + 2] == 3) { if (flow->l4.udp.snmp_msg_id != ntohs(get_u_int32_t(packet->payload, offset + 8))) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP v3 excluded, message ID doesn't match\n"); goto excl; } } else if (packet->payload[offset + 2] == 0) { if (flow->l4.udp.snmp_msg_id != get_u_int8_t(packet->payload, offset + 15)) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP v1 excluded, message ID doesn't match\n"); goto excl; } } else { if (flow->l4.udp.snmp_msg_id != ntohs(get_u_int16_t(packet->payload, offset + 15))) { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP v2 excluded, message ID doesn't match\n"); goto excl; } } NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP detected.\n"); ndpi_int_snmp_add_connection(ndpi_struct, flow); return; } } else { NDPI_LOG(NDPI_PROTOCOL_SNMP, ndpi_struct, NDPI_LOG_DEBUG, "SNMP excluded.\n"); } excl: NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SNMP); } void init_snmp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SNMP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SNMP, ndpi_search_snmp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/socks45.c000066400000000000000000000143171321103654100171710ustar00rootroot00000000000000/* * socks4.c * * Copyright (C) 2016 - ntop.org * Copyright (C) 2014 Tomasz Bujlow * * The signature is based on the Libprotoident library. * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_SOCKS static void ndpi_int_socks_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOCKS, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_socks4(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Break after 20 packets. */ if(flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "Exclude SOCKS4.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOCKS); return; } /* Check if we so far detected the protocol in the request or not. */ if(flow->socks4_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "SOCKS4 stage 0: \n"); if(payload_len >= 9 && packet->payload[0] == 0x04 && (packet->payload[1] == 0x01 || packet->payload[1] == 0x02) && packet->payload[payload_len - 1] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "Possible SOCKS4 request detected, we will look further for the response...\n"); /* TODO: check port and ip address is valid */ /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->socks4_stage = packet->packet_direction + 1; } } else { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "SOCKS4 stage %u: \n", flow->socks4_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if((flow->socks4_stage - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if(payload_len == 8 && packet->payload[0] == 0x00 && packet->payload[1] >= 0x5a && packet->payload[1] <= 0x5d) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "Found SOCKS4.\n"); ndpi_int_socks_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to SOCKS4, resetting the stage to 0...\n"); flow->socks4_stage = 0; } } } static void ndpi_check_socks5(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Break after 20 packets. */ if(flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "Exclude SOCKS5.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOCKS); return; } /* Check if we so far detected the protocol in the request or not. */ if(flow->socks5_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "SOCKS5 stage 0: \n"); if((payload_len == 3) && (packet->payload[0] == 0x05) && (packet->payload[1] == 0x01) && (packet->payload[2] == 0x00)) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "Possible SOCKS5 request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->socks5_stage = packet->packet_direction + 1; } } else { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "SOCKS5 stage %u: \n", flow->socks5_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if((flow->socks5_stage - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if((payload_len == 0) || ((payload_len == 2) && (packet->payload[0] == 0x05) && (packet->payload[1] == 0x00))) { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "Found SOCKS5.\n"); ndpi_int_socks_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to SOCKS5, resetting the stage to 0...\n"); flow->socks5_stage = 0; } } } void ndpi_search_socks(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_SOCKS, ndpi_struct, NDPI_LOG_DEBUG, "SOCKS detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_SOCKS) { if(packet->tcp_retransmission == 0) { ndpi_check_socks4(ndpi_struct, flow); if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_SOCKS) ndpi_check_socks5(ndpi_struct, flow); } } } void init_socks_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SOCKS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SOCKS, ndpi_search_socks, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/socrates.c000066400000000000000000000065101321103654100175150ustar00rootroot00000000000000/* * socrates.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SOCRATES static void ndpi_socrates_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOCRATES, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_socrates(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "search socrates.\n"); if (packet->udp != NULL) { if (packet->payload_packet_len > 9 && packet->payload[0] == 0xfe && packet->payload[packet->payload_packet_len - 1] == 0x05) { NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "found fe.\n"); NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "len match.\n"); if (memcmp(&packet->payload[2], "socrates", 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "found socrates udp.\n"); ndpi_socrates_add_connection(ndpi_struct, flow); } } } else if (packet->tcp != NULL) { if (packet->payload_packet_len > 13 && packet->payload[0] == 0xfe && packet->payload[packet->payload_packet_len - 1] == 0x05) { NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "found fe.\n"); if (packet->payload_packet_len == ntohl(get_u_int32_t(packet->payload, 2))) { NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "len match.\n"); if (memcmp(&packet->payload[6], "socrates", 8) == 0) { NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "found socrates tcp.\n"); ndpi_socrates_add_connection(ndpi_struct, flow); } } } } NDPI_LOG(NDPI_PROTOCOL_SOCRATES, ndpi_struct, NDPI_LOG_DEBUG, "exclude socrates.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOCRATES); } void init_socrates_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Socrates", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SOCRATES, ndpi_search_socrates, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/someip.c000066400000000000000000000221751321103654100171730ustar00rootroot00000000000000/* * someip.c * * Copyright (C) 2016 Sorin Zamfir * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your omessage_typeion) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SOMEIP enum SOMEIP_MESSAGE_TYPES { SOMEIP_REQUEST = 0x00, SOMEIP_REQUEST_NO_RETURN = 0x01, SOMEIP_NOTIFICATION = 0x02, SOMEIP_REQUEST_ACK = 0x40, SOMEIP_REQUEST_NO_RETURN_ACK = 0x41, SOMEIP_NOTIFICATION_ACK = 0x42, SOMEIP_RESPONSE = 0x80, SOMEIP_ERROR = 0x81, SOMEIP_RESPONSE_ACK = 0xc0, SOMEIP_ERROR_ACK = 0xc1 }; enum SOMEIP_RETURN_CODES { E_OK = 0x00, E_NOT_OK = 0x01, E_UNKNOWN_SERVICE = 0x02, E_UNKNOWN_METHOD = 0x03, E_NOT_READY = 0x04, E_NOT_REACHABLE = 0x05, E_TIMEOUT = 0x06, E_WRONG_PROTOCOL_VERSION = 0x07, E_WRONG_INTERFACE_VERSION = 0x08, E_MALFORMED_MESSAGE = 0x09, E_WRONG_MESSAGE_TYPE = 0x0a, E_RETURN_CODE_LEGAL_THRESHOLD = 0x40 //return codes from 0x40 (inclusive) and upwards are illegal. }; enum SPECIAL_MESSAGE_IDS { MSG_MAGIC_COOKIE = 0xffff0000, MSG_MAGIC_COOKIE_ACK = 0xffff8000, MSG_SD = 0xffff8100 }; enum PROTOCOL_VERSION{ LEGAL_PROTOCOL_VERSION = 0x01 }; enum MAGIC_COOKIE_CONSTANTS{ MC_REQUEST_ID = 0xDEADBEEF, MC_LENGTH = 0x08, MC_INTERFACE_VERSION = 0x01 }; enum DEFAULT_PROTOCOL_PORTS{ PORT_DEFAULT_CLIENT = 30491, PORT_DEFAULT_SERVER = 30501, PORT_DEFAULT_SD = 30490 }; /** * Entry point when protocol is identified. */ static void ndpi_int_someip_add_connection (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_SOMEIP,NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found.\n"); } /** * Dissector function that searches SOME/IP headers */ void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { const struct ndpi_packet_struct *packet = &flow->packet; if (packet->payload_packet_len < 16) { NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. mandatory header not found (not enough data for all fields)\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } //####Maybe check carrier protocols?#### NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP search called...\n"); if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) { return; } //we extract the Message ID and Request ID and check for special cases later u_int32_t message_id = ntohl(*((u_int32_t *)&packet->payload[0])); u_int32_t request_id = ntohl(*((u_int32_t *)&packet->payload[8])); NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> SOME/IP Message ID: %08x [len: %u]\n", message_id, packet->payload_packet_len); //####Maximum packet size in SOMEIP depends on the carrier protocol, and I'm not certain how well enforced it is, so let's leave that for round 2#### // we extract the remaining length u_int32_t someip_len = ntohl(*((u_int32_t *)&packet->payload[4])); if (packet->payload_packet_len != (someip_len + 8)) { NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. Length field invalid!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } u_int8_t protocol_version = (u_int8_t) (packet->payload[12]); NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP protocol version: [%d]\n",protocol_version); if (protocol_version != LEGAL_PROTOCOL_VERSION){ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid protocol version!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } u_int8_t interface_version = (packet->payload[13]); u_int8_t message_type = (u_int8_t) (packet->payload[14]); NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP message type: [%d]\n",message_type); if ((message_type != SOMEIP_REQUEST) && (message_type != SOMEIP_REQUEST_NO_RETURN) && (message_type != SOMEIP_NOTIFICATION) && (message_type != SOMEIP_REQUEST_ACK) && (message_type != SOMEIP_REQUEST_NO_RETURN_ACK) && (message_type != SOMEIP_NOTIFICATION_ACK) && (message_type != SOMEIP_RESPONSE) && (message_type != SOMEIP_ERROR) && (message_type != SOMEIP_RESPONSE_ACK) && (message_type != SOMEIP_ERROR_ACK)) { NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid message type!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } u_int8_t return_code = (u_int8_t) (packet->payload[15]); NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP return code: [%d]\n", return_code); if ((return_code >= E_RETURN_CODE_LEGAL_THRESHOLD)) { NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid return code!\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } if (message_id == MSG_MAGIC_COOKIE){ if ((someip_len == MC_LENGTH) && (request_id == MC_REQUEST_ID) && (interface_version == MC_INTERFACE_VERSION) && (message_type == SOMEIP_REQUEST_NO_RETURN) && (return_code == E_OK)){ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found Magic Cookie\n",message_type); ndpi_int_someip_add_connection(ndpi_struct, flow); return; } else{ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP, invalid header for Magic Cookie\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } } if (message_id == MSG_MAGIC_COOKIE_ACK){ if ((someip_len == MC_LENGTH) && (request_id == MC_REQUEST_ID) && (interface_version == MC_INTERFACE_VERSION) && (message_type == SOMEIP_REQUEST_NO_RETURN) && (return_code == E_OK)){ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found Magic Cookie ACK\n",message_type); ndpi_int_someip_add_connection(ndpi_struct, flow); return; } else{ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP, invalid header for Magic Cookie ACK\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } } if (message_id == MSG_SD){ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP-SD currently not supported\n", message_type); } //Filtering by port. //This check is NOT a 100% thing - these ports are mentioned in the documentation but the documentation also states they haven't been approved by IANA yet, and that the user is free to use different ports. //This is is PURELY for demo purposes and the rest of the check must be filled in later on! if (packet->l4_protocol == IPPROTO_UDP){ if ((packet->udp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SERVER)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SD))) { NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found\n",message_type); ndpi_int_someip_add_connection(ndpi_struct, flow); return; } } if (packet->l4_protocol == IPPROTO_TCP){ if ((packet->tcp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->tcp->dest == ntohs(PORT_DEFAULT_SERVER))) { NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found\n",message_type); ndpi_int_someip_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Reached the end without confirming SOME/IP ...\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP); return; } /** * Entry point for the ndpi library */ void init_someip_dissector (struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP dissector init...\n"); ndpi_set_bitmask_protocol_detection ("SOME/IP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SOMEIP, ndpi_search_someip, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id +=1; } #endif // NDPI_PROTOCOL_SOMEIP nDPI-2.2/src/lib/protocols/sopcast.c000066400000000000000000000221001321103654100173370ustar00rootroot00000000000000/* * sopcast.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SOPCAST static void ndpi_int_sopcast_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOPCAST, NDPI_PROTOCOL_UNKNOWN); } /** * this function checks for sopcast tcp pattern * * NOTE: if you add more patterns please keep the number of if levels * low, it is already complex enough */ #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_int_is_sopcast_tcp(const u_int8_t * payload, const u_int16_t payload_len) { if (payload_len != 54) return 0; if (payload[2] != payload[3] - 4 && payload[2] != payload[3] + 4) return 0; if (payload[2] != payload[4] - 1 && payload[2] != payload[4] + 1) return 0; if (payload[25] != payload[25 + 16 - 1] + 1 && payload[25] != payload[25 + 16 - 1] - 1) { if (payload[3] != payload[25] && payload[3] != payload[25] - 4 && payload[3] != payload[25] + 4 && payload[3] != payload[25] - 21) { return 0; } } if (payload[4] != payload[28] || payload[28] != payload[30] || payload[30] != payload[31] || get_u_int16_t(payload, 30) != get_u_int16_t(payload, 32) || get_u_int16_t(payload, 32) != get_u_int16_t(payload, 34)) { if ((payload[2] != payload[5] - 1 && payload[2] != payload[5] + 1) || payload[2] != payload[25] || payload[4] != payload[28] || payload[4] != payload[31] || payload[4] != payload[32] || payload[4] != payload[33] || payload[4] != payload[34] || payload[4] != payload[35] || payload[4] != payload[30] || payload[2] != payload[36]) { return 0; } } if (payload[42] != payload[53]) return 0; if (payload[45] != payload[46] + 1 && payload[45] != payload[46] - 1) return 0; if (payload[45] != payload[49] || payload[46] != payload[50] || payload[47] != payload[51]) return 0; return 1; } static void ndpi_search_sopcast_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (flow->packet_counter == 1 && packet->payload_packet_len == 54 && get_u_int16_t(packet->payload, 0) == ntohs(0x0036)) { if (ndpi_int_is_sopcast_tcp(packet->payload, packet->payload_packet_len)) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast TCP \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "exclude sopcast TCP. \n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOPCAST); } static void ndpi_search_sopcast_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "search sopcast. \n"); if (packet->payload_packet_len == 52 && packet->payload[0] == 0xff && packet->payload[1] == 0xff && packet->payload[2] == 0x01 && packet->payload[8] == 0x02 && packet->payload[9] == 0xff && packet->payload[10] == 0x00 && packet->payload[11] == 0x2c && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast with if I. \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } if ((packet->payload_packet_len == 80 || packet->payload_packet_len == 28 || packet->payload_packet_len == 94) && packet->payload[0] == 0x00 && (packet->payload[2] == 0x02 || packet->payload[2] == 0x01) && packet->payload[8] == 0x01 && packet->payload[9] == 0xff && packet->payload[10] == 0x00 && packet->payload[11] == 0x14 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast with if II. \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } /* this case has been seen once. Please remove this comment, if you see it another time */ if (packet->payload_packet_len == 60 && packet->payload[0] == 0x00 && packet->payload[2] == 0x01 && packet->payload[8] == 0x03 && packet->payload[9] == 0xff && packet->payload[10] == 0x00 && packet->payload[11] == 0x34 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast with if III. \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 42 && packet->payload[0] == 0x00 && packet->payload[1] == 0x02 && packet->payload[2] == 0x01 && packet->payload[3] == 0x07 && packet->payload[4] == 0x03 && packet->payload[8] == 0x06 && packet->payload[9] == 0x01 && packet->payload[10] == 0x00 && packet->payload[11] == 0x22 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast with if IV. \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 28 && packet->payload[0] == 0x00 && packet->payload[1] == 0x0c && packet->payload[2] == 0x01 && packet->payload[3] == 0x07 && packet->payload[4] == 0x00 && packet->payload[8] == 0x01 && packet->payload[9] == 0x01 && packet->payload[10] == 0x00 && packet->payload[11] == 0x14 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast with if V. \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } /* this case has been seen once. Please remove this comment, if you see it another time */ if (packet->payload_packet_len == 286 && packet->payload[0] == 0x00 && packet->payload[1] == 0x02 && packet->payload[2] == 0x01 && packet->payload[3] == 0x07 && packet->payload[4] == 0x03 && packet->payload[8] == 0x06 && packet->payload[9] == 0x01 && packet->payload[10] == 0x01 && packet->payload[11] == 0x16 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast with if VI. \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 76 && packet->payload[0] == 0xff && packet->payload[1] == 0xff && packet->payload[2] == 0x01 && packet->payload[8] == 0x0c && packet->payload[9] == 0xff && packet->payload[10] == 0x00 && packet->payload[11] == 0x44 && packet->payload[16] == 0x01 && packet->payload[15] == 0x01 && packet->payload[12] == 0x00 && packet->payload[13] == 0x00 && packet->payload[14] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "found sopcast with if VII. \n"); ndpi_int_sopcast_add_connection(ndpi_struct, flow); return; } /* Attention please: no asymmetric detection necessary. This detection works asymmetrically as well. */ NDPI_LOG(NDPI_PROTOCOL_SOPCAST, ndpi_struct, NDPI_LOG_DEBUG, "exclude sopcast. \n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOPCAST); } void ndpi_search_sopcast(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->udp != NULL) ndpi_search_sopcast_udp(ndpi_struct, flow); if (packet->tcp != NULL) ndpi_search_sopcast_tcp(ndpi_struct, flow); } void init_sopcast_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Sopcast", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SOPCAST, ndpi_search_sopcast, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/soulseek.c000066400000000000000000000326401321103654100175270ustar00rootroot00000000000000/* * soulseek.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SOULSEEK void ndpi_search_soulseek_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if(packet->tcp) { if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SOULSEEK) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "packet marked as Soulseek\n"); if(src != NULL) NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, " SRC bitmask: %u, packet tick %llu , last safe access timestamp: %llu\n", NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_SOULSEEK) != 0 ? 1 : 0, (u_int64_t) packet->tick_timestamp, (u_int64_t) src->soulseek_last_safe_access_time); if(dst != NULL) NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, " DST bitmask: %u, packet tick %llu , last safe ts: %llu\n", NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_SOULSEEK) != 0 ? 1 : 0, (u_int64_t) packet->tick_timestamp, (u_int64_t) dst->soulseek_last_safe_access_time); if(packet->payload_packet_len == 431) { if(dst != NULL) { dst->soulseek_last_safe_access_time = packet->tick_timestamp; } return; } if(packet->payload_packet_len == 12 && get_l32(packet->payload, 4) == 0x02) { if(src != NULL) { src->soulseek_last_safe_access_time = packet->tick_timestamp; if(packet->tcp != NULL && src->soulseek_listen_port == 0) { src->soulseek_listen_port = get_l32(packet->payload, 8); return; } } } if(src != NULL && ((u_int32_t)(packet->tick_timestamp - src->soulseek_last_safe_access_time) < ndpi_struct->soulseek_connection_ip_tick_timeout)) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "Soulseek: SRC update last safe access time and SKIP_FOR_TIME \n"); src->soulseek_last_safe_access_time = packet->tick_timestamp; } if(dst != NULL && ((u_int32_t)(packet->tick_timestamp - dst->soulseek_last_safe_access_time) < ndpi_struct->soulseek_connection_ip_tick_timeout)) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "Soulseek: DST update last safe access time and SKIP_FOR_TIME \n"); dst->soulseek_last_safe_access_time = packet->tick_timestamp; } } if(dst != NULL && dst->soulseek_listen_port != 0 && dst->soulseek_listen_port == ntohs(packet->tcp->dest) && ((u_int32_t)(packet->tick_timestamp - dst->soulseek_last_safe_access_time) < ndpi_struct->soulseek_connection_ip_tick_timeout)) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "Soulseek: Plain detection on Port : %u packet_tick_timestamp: %u soulseek_last_safe_access_time: %u soulseek_connection_ip_ticktimeout: %u\n", dst->soulseek_listen_port, packet->tick_timestamp, dst->soulseek_last_safe_access_time, ndpi_struct->soulseek_connection_ip_tick_timeout); dst->soulseek_last_safe_access_time = packet->tick_timestamp; if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } if(flow->l4.tcp.soulseek_stage == 0) { u_int32_t index = 0; if(packet->payload_packet_len >= 12 && packet->payload_packet_len < 300 && get_l32(packet->payload, 4) == 1) { while (!get_u_int16_t(packet->payload, index + 2) && (index + get_l32(packet->payload, index)) < packet->payload_packet_len - 4) { if(get_l32(packet->payload, index) < 8) /*Minimum soulseek login msg is 8B */ break; if(index + get_l32(packet->payload, index) + 4 <= index) { /* avoid overflow */ break; } index += get_l32(packet->payload, index) + 4; } if(index + get_l32(packet->payload, index) == packet->payload_packet_len - 4 && !get_u_int16_t(packet->payload, 10)) { /* This structure seems to be soulseek proto */ index = get_l32(packet->payload, 8) + 12; // end of "user name" if((index + 4) <= packet->payload_packet_len && !get_u_int16_t(packet->payload, index + 2)) // for passwd len { index += get_l32(packet->payload, index) + 4; //end of "Passwd" if((index + 4 + 4) <= packet->payload_packet_len && !get_u_int16_t(packet->payload, index + 6)) // to read version,hashlen { index += get_l32(packet->payload, index + 4) + 8; // enf of "hash value" if(index == get_l32(packet->payload, 0)) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "Soulseek Login Detected\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } } } } } if (packet->payload_packet_len > 8 && packet->payload_packet_len < 200 && get_l32(packet->payload, 0) == packet->payload_packet_len - 4) { //Server Messages: const u_int32_t msgcode = get_l32(packet->payload, 4); if(msgcode == 0x7d) { flow->l4.tcp.soulseek_stage = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "Soulseek Messages Search\n"); return; } else if(msgcode == 0x02 && packet->payload_packet_len == 12) { const u_int32_t soulseek_listen_port = get_l32(packet->payload, 8); if(src != NULL) { src->soulseek_last_safe_access_time = packet->tick_timestamp; if(packet->tcp != NULL && src->soulseek_listen_port == 0) { src->soulseek_listen_port = soulseek_listen_port; NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "\n Listen Port Saved : %u", src->soulseek_listen_port); if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } } } //Peer Messages : Peer Init Message Detection if(get_l32(packet->payload, 0) == packet->payload_packet_len - 4) { const u_int32_t typelen = get_l32(packet->payload, packet->payload_packet_len - 9); const u_int8_t type = packet->payload[packet->payload_packet_len - 5]; const u_int32_t namelen = get_l32(packet->payload, 5); if(packet->payload[4] == 0x01 && typelen == 1 && namelen <= packet->payload_packet_len && (4 + 1 + 4 + namelen + 4 + 1 + 4) == packet->payload_packet_len && (type == 'F' || type == 'P' || type == 'D')) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "soulseek detected\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "1\n"); } NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "3\n"); //Peer Message : Pierce Firewall if(packet->payload_packet_len == 9 && get_l32(packet->payload, 0) == 5 && packet->payload[4] <= 0x10 && get_u_int32_t(packet->payload, 5) != 0x00000000) { flow->l4.tcp.soulseek_stage = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_TRACE, "Soulseek Size 9 Pierce Firewall\n"); return; } } if(packet->payload_packet_len > 25 && packet->payload[4] == 0x01 && !get_u_int16_t(packet->payload, 7) && !get_u_int16_t(packet->payload, 2)) { const u_int32_t usrlen = get_l32(packet->payload, 5); if(usrlen <= packet->payload_packet_len - 4 + 1 + 4 + 4 + 1 + 4) { const u_int32_t typelen = get_l32(packet->payload, 4 + 1 + 4 + usrlen); const u_int8_t type = packet->payload[4 + 1 + 4 + usrlen + 4]; if(typelen == 1 && (type == 'F' || type == 'P' || type == 'D')) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "soulseek detected Pattern command(D|P|F).\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } } } } else if(flow->l4.tcp.soulseek_stage == 2 - packet->packet_direction) { if(packet->payload_packet_len > 8) { if((packet->payload[0] || packet->payload[1]) && get_l32(packet->payload, 4) == 9) { /* 9 is search result */ NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "soulseek detected Second Pkt\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } if(get_l32(packet->payload, 0) == packet->payload_packet_len - 4) { const u_int32_t msgcode = get_l32(packet->payload, 4); if(msgcode == 0x03 && packet->payload_packet_len >= 12) //Server Message : Get Peer Address { const u_int32_t usrlen = get_l32(packet->payload, 8); if(usrlen <= packet->payload_packet_len && 4 + 4 + 4 + usrlen == packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "Soulseek Request Get Peer Address Detected\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } } } } if(packet->payload_packet_len == 8 && get_l32(packet->payload, 4) == 0x00000004) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "soulseek detected\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } if(packet->payload_packet_len == 4 && get_u_int16_t(packet->payload, 2) == 0x00 && get_u_int16_t(packet->payload, 0) != 0x00) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "soulseek detected\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } else if(packet->payload_packet_len == 4) { flow->l4.tcp.soulseek_stage = 3; return; } } else if(flow->l4.tcp.soulseek_stage == 1 + packet->packet_direction) { if(packet->payload_packet_len > 8) { if(packet->payload[4] == 0x03 && get_l32(packet->payload, 5) == 0x00000031) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "soulseek detected Second Pkt with SIGNATURE :: 0x0331000000 \n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } } } if(flow->l4.tcp.soulseek_stage == 3 && packet->payload_packet_len == 8 && !get_u_int32_t(packet->payload, 4)) { NDPI_LOG(NDPI_PROTOCOL_SOULSEEK, ndpi_struct, NDPI_LOG_DEBUG, "soulseek detected bcz of 8B pkt\n"); if(src != NULL) src->soulseek_last_safe_access_time = packet->tick_timestamp; if(dst != NULL) dst->soulseek_last_safe_access_time = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SOULSEEK, NDPI_PROTOCOL_UNKNOWN); return; } if(flow->l4.tcp.soulseek_stage && flow->packet_counter < 11) { } else { NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOULSEEK); } } } void init_soulseek_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Soulseek", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SOULSEEK, ndpi_search_soulseek_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/spotify.c000066400000000000000000000121501321103654100173640ustar00rootroot00000000000000/* * spotify.c * * Copyright (C) 2011-13 by ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_SPOTIFY static void ndpi_int_spotify_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t due_to_correlation) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_spotify(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { u_int16_t spotify_port = htons(57621); if((packet->udp->source == spotify_port) && (packet->udp->dest == spotify_port)) { if(payload_len > 2) { if(memcmp(packet->payload, "SpotUdp", 7) == 0) { NDPI_LOG(NDPI_PROTOCOL_SPOTIFY, ndpi_struct, NDPI_LOG_DEBUG, "Found spotify udp dissector.\n"); ndpi_int_spotify_add_connection(ndpi_struct, flow, 0); return; } } } } else if(packet->tcp != NULL) { if(payload_len >= 8 && packet->payload[0] == 0x00 && packet->payload[1] == 0x04 && packet->payload[2] == 0x00 && packet->payload[3] == 0x00&& packet->payload[6] == 0x52 && packet->payload[7] == 0x0e && packet->payload[8] == 0x50 ) { NDPI_LOG(NDPI_PROTOCOL_SPOTIFY, ndpi_struct, NDPI_LOG_DEBUG, "Found spotify tcp dissector.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_UNKNOWN); } if(packet->iph /* IPv4 Only: we need to support packet->iphv6 at some point */) { /* if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) */ { /* Spotify 78.31.8.0 - 78.31.15.255 (78.31.8.0/22) AS29017 193.235.232.0 - 193.235.235.255 (193.235.232.0/22) AS29017 194.132.196.0 - 194.132.199.255 (194.132.198.147/22) AS43650 194.132.176.0 - 194.132.179.255 (194.132.176.0/22) AS43650 194.132.162.0 - 194.132.163.255 (194.132.162.0/24) AS43650 */ //printf("%08X - %08X\n", ntohl(packet->iph->saddr), ntohl(packet->iph->daddr)); if(((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0x4E1F0800 /* 78.31.8.0 */) || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0x4E1F0800 /* 78.31.8.0 */) /* **** */ || ((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC1EBE800 /* 193.235.232.0 */) || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC1EBE800 /* 193.235.232.0 */) /* **** */ || ((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284C400 /* 194.132.196.0 */) || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284C400 /* 194.132.196.0 */) /* **** */ || ((ntohl(packet->iph->saddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284A200 /* 194.132.162.0 */) || ((ntohl(packet->iph->daddr) & 0xFFFFFC00 /* 255.255.252.0 */) == 0xC284A200 /* 194.132.162.0 */) ) { NDPI_LOG(NDPI_PROTOCOL_SPOTIFY, ndpi_struct, NDPI_LOG_DEBUG, "Found spotify via ip range.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_UNKNOWN); return; } } } } NDPI_LOG(NDPI_PROTOCOL_SPOTIFY, ndpi_struct, NDPI_LOG_DEBUG, "exclude spotify.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SPOTIFY); } void ndpi_search_spotify(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_SPOTIFY, ndpi_struct, NDPI_LOG_DEBUG, "spotify detection...\n"); /* skip marked packets */ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_SPOTIFY) { if (packet->tcp_retransmission == 0) { ndpi_check_spotify(ndpi_struct, flow); } } } void init_spotify_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SPOTIFY", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SPOTIFY, ndpi_search_spotify, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ssdp.c000066400000000000000000000053771321103654100166550ustar00rootroot00000000000000/* * ssdp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SSDP static void ndpi_int_ssdp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSDP, NDPI_PROTOCOL_UNKNOWN); } /* this detection also works asymmetrically */ void ndpi_search_ssdp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_SSDP, ndpi_struct, NDPI_LOG_DEBUG, "search ssdp.\n"); if (packet->udp != NULL) { if (packet->payload_packet_len > 100) { if ((memcmp(packet->payload, "M-SEARCH * HTTP/1.1", 19) == 0) || memcmp(packet->payload, "NOTIFY * HTTP/1.1", 17) == 0) { NDPI_LOG(NDPI_PROTOCOL_SSDP, ndpi_struct, NDPI_LOG_DEBUG, "found ssdp.\n"); ndpi_int_ssdp_add_connection(ndpi_struct, flow); return; } #define SSDP_HTTP "HTTP/1.1 200 OK\r\n" if(memcmp(packet->payload, SSDP_HTTP, strlen(SSDP_HTTP)) == 0) { NDPI_LOG(NDPI_PROTOCOL_SSDP, ndpi_struct, NDPI_LOG_DEBUG, "found ssdp.\n"); ndpi_int_ssdp_add_connection(ndpi_struct, flow); return; } } } NDPI_LOG(NDPI_PROTOCOL_SSDP, ndpi_struct, NDPI_LOG_DEBUG, "ssdp excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SSDP); } void init_ssdp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SSDP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SSDP, ndpi_search_ssdp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ssh.c000066400000000000000000000070321321103654100164670ustar00rootroot00000000000000/* * ssh.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SSH static void ndpi_int_ssh_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow){ ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSH, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_ssh_zap_cr(char *str, int len) { len--; while(len > 0) { if((str[len] == '\n') || (str[len] == '\r')) { str[len] = '\0'; len--; } else break; } } void ndpi_search_ssh_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (flow->l4.tcp.ssh_stage == 0) { if (packet->payload_packet_len > 7 && packet->payload_packet_len < 100 && memcmp(packet->payload, "SSH-", 4) == 0) { int len = ndpi_min(sizeof(flow->protos.ssh.client_signature)-1, packet->payload_packet_len); strncpy(flow->protos.ssh.client_signature, (const char *)packet->payload, len); flow->protos.ssh.client_signature[len] = '\0'; ndpi_ssh_zap_cr(flow->protos.ssh.client_signature, len); NDPI_LOG(NDPI_PROTOCOL_SSH, ndpi_struct, NDPI_LOG_DEBUG, "ssh stage 0 passed\n"); flow->l4.tcp.ssh_stage = 1 + packet->packet_direction; return; } } else if (flow->l4.tcp.ssh_stage == (2 - packet->packet_direction)) { if (packet->payload_packet_len > 7 && packet->payload_packet_len < 100 && memcmp(packet->payload, "SSH-", 4) == 0) { int len = ndpi_min(sizeof(flow->protos.ssh.server_signature)-1, packet->payload_packet_len); strncpy(flow->protos.ssh.server_signature, (const char *)packet->payload, len); flow->protos.ssh.server_signature[len] = '\0'; ndpi_ssh_zap_cr(flow->protos.ssh.server_signature, len); NDPI_LOG(NDPI_PROTOCOL_SSH, ndpi_struct, NDPI_LOG_DEBUG, "found ssh\n"); ndpi_int_ssh_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_SSH, ndpi_struct, NDPI_LOG_DEBUG, "excluding ssh at stage %d\n", flow->l4.tcp.ssh_stage); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SSH); } void init_ssh_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SSH", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SSH, ndpi_search_ssh_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ssl.c000066400000000000000000000641471321103654100165050ustar00rootroot00000000000000/* * ssl.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_SSL /* #define CERTIFICATE_DEBUG 1 */ #define NDPI_MAX_SSL_REQUEST_SIZE 10000 /* Skype.c */ extern u_int8_t is_skype_flow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); static u_int32_t ndpi_ssl_refine_master_protocol(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int32_t protocol) { struct ndpi_packet_struct *packet = &flow->packet; if((flow->protos.ssl.client_certificate[0] != '\0') || (flow->protos.ssl.server_certificate[0] != '\0') || (flow->host_server_name[0] != '\0')) protocol = NDPI_PROTOCOL_SSL; else protocol = NDPI_PROTOCOL_SSL_NO_CERT; if(packet->tcp != NULL) { switch(protocol) { case NDPI_PROTOCOL_SSL: case NDPI_PROTOCOL_SSL_NO_CERT: { /* In case of SSL there are probably sub-protocols such as IMAPS that can be otherwise detected */ u_int16_t sport = ntohs(packet->tcp->source); u_int16_t dport = ntohs(packet->tcp->dest); if((sport == 465) || (dport == 465)) protocol = NDPI_PROTOCOL_MAIL_SMTPS; else if((sport == 993) || (dport == 993) #ifdef NDPI_PROTOCOL_MAIL_IMAP || (flow->l4.tcp.mail_imap_starttls) #endif ) protocol = NDPI_PROTOCOL_MAIL_IMAPS; else if((sport == 995) || (dport == 995)) protocol = NDPI_PROTOCOL_MAIL_POPS; } break; } } return protocol; } static void ndpi_int_ssl_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int32_t protocol) { if((protocol != NDPI_PROTOCOL_SSL) && (protocol != NDPI_PROTOCOL_SSL_NO_CERT)) { ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_UNKNOWN); } else { protocol = ndpi_ssl_refine_master_protocol(ndpi_struct, flow, protocol); ndpi_set_detected_protocol(ndpi_struct, flow, protocol, NDPI_PROTOCOL_UNKNOWN); } } /* Can't call libc functions from kernel space, define some stub instead */ #define ndpi_isalpha(ch) (((ch) >= 'a' && (ch) <= 'z') || ((ch) >= 'A' && (ch) <= 'Z')) #define ndpi_isdigit(ch) ((ch) >= '0' && (ch) <= '9') #define ndpi_isspace(ch) (((ch) >= '\t' && (ch) <= '\r') || ((ch) == ' ')) #define ndpi_isprint(ch) ((ch) >= 0x20 && (ch) <= 0x7e) #define ndpi_ispunct(ch) (((ch) >= '!' && (ch) <= '/') || \ ((ch) >= ':' && (ch) <= '@') || \ ((ch) >= '[' && (ch) <= '`') || \ ((ch) >= '{' && (ch) <= '~')) static void stripCertificateTrailer(char *buffer, int buffer_len) { int i, is_puny; // printf("->%s<-\n", buffer); for(i = 0; i < buffer_len; i++) { // printf("%c [%d]\n", buffer[i], buffer[i]); if((buffer[i] != '.') && (buffer[i] != '-') && (buffer[i] != '_') && (buffer[i] != '*') && (!ndpi_isalpha(buffer[i])) && (!ndpi_isdigit(buffer[i]))) { buffer[i] = '\0'; buffer_len = i; break; } } /* check for punycode encoding */ is_puny = check_punycode_string(buffer, buffer_len); // not a punycode string - need more checks if(is_puny == 0) { if(i > 0) i--; while(i > 0) { if(!ndpi_isalpha(buffer[i])) { buffer[i] = '\0'; buffer_len = i; i--; } else break; } for(i = buffer_len; i > 0; i--) { if(buffer[i] == '.') break; else if(ndpi_isdigit(buffer[i])) buffer[i] = '\0', buffer_len = i; } } } /* Code fixes courtesy of Alexsandro Brahm */ int getSSLcertificate(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *buffer, int buffer_len) { struct ndpi_packet_struct *packet = &flow->packet; #ifdef CERTIFICATE_DEBUG { static u_int8_t id = 0; printf("-> [%u] %02X\n", ++id, packet->payload[0] & 0xFF); } #endif /* Nothing matched so far: let's decode the certificate with some heuristics Patches courtesy of Denys Fedoryshchenko */ if(packet->payload[0] == 0x16 /* Handshake */) { u_int16_t total_len = (packet->payload[3] << 8) + packet->payload[4] + 5 /* SSL Header */; u_int8_t handshake_protocol = packet->payload[5]; /* handshake protocol a bit misleading, it is message type according TLS specs */ memset(buffer, 0, buffer_len); /* Truncate total len, search at least in incomplete packet */ if(total_len > packet->payload_packet_len) total_len = packet->payload_packet_len; /* At least "magic" 3 bytes, null for string end, otherwise no need to waste cpu cycles */ if(total_len > 4) { int i; if(handshake_protocol == 0x02 || handshake_protocol == 0xb /* Server Hello and Certificate message types are interesting for us */) { u_int num_found = 0; flow->l4.tcp.ssl_seen_server_cert = 1; /* Check after handshake protocol header (5 bytes) and message header (4 bytes) */ for(i = 9; i < packet->payload_packet_len-3; i++) { if(((packet->payload[i] == 0x04) && (packet->payload[i+1] == 0x03) && (packet->payload[i+2] == 0x0c)) || ((packet->payload[i] == 0x04) && (packet->payload[i+1] == 0x03) && (packet->payload[i+2] == 0x13)) || ((packet->payload[i] == 0x55) && (packet->payload[i+1] == 0x04) && (packet->payload[i+2] == 0x03))) { u_int8_t server_len = packet->payload[i+3]; if(packet->payload[i] == 0x55) { num_found++; if(num_found != 2) continue; } if(server_len+i+3 < packet->payload_packet_len) { char *server_name = (char*)&packet->payload[i+4]; u_int8_t begin = 0, len, j, num_dots; while(begin < server_len) { if(!ndpi_isprint(server_name[begin])) begin++; else break; } // len = ndpi_min(server_len-begin, buffer_len-1); len = buffer_len-1; strncpy(buffer, &server_name[begin], len); buffer[len] = '\0'; /* We now have to check if this looks like an IP address or host name */ for(j=0, num_dots = 0; j=2) break; } } if(num_dots >= 2) { stripCertificateTrailer(buffer, buffer_len); snprintf(flow->protos.ssl.server_certificate, sizeof(flow->protos.ssl.server_certificate), "%s", buffer); return(1 /* Server Certificate */); } } } } } else if(handshake_protocol == 0x01 /* Client Hello */) { u_int offset, base_offset = 43; if (base_offset + 2 <= packet->payload_packet_len) { u_int16_t session_id_len = packet->payload[base_offset]; if((session_id_len+base_offset+2) <= total_len) { u_int16_t cypher_len = packet->payload[session_id_len+base_offset+2] + (packet->payload[session_id_len+base_offset+1] << 8); offset = base_offset + session_id_len + cypher_len + 2; flow->l4.tcp.ssl_seen_client_cert = 1; if(offset < total_len) { u_int16_t compression_len; u_int16_t extensions_len; compression_len = packet->payload[offset+1]; offset += compression_len + 3; if(offset < total_len) { extensions_len = packet->payload[offset]; if((extensions_len+offset) < total_len) { /* Move to the first extension Type is u_int to avoid possible overflow on extension_len addition */ u_int extension_offset = 1; while(extension_offset < extensions_len) { u_int16_t extension_id, extension_len; memcpy(&extension_id, &packet->payload[offset+extension_offset], 2); extension_offset += 2; memcpy(&extension_len, &packet->payload[offset+extension_offset], 2); extension_offset += 2; extension_id = ntohs(extension_id), extension_len = ntohs(extension_len); if(extension_id == 0) { u_int begin = 0,len; char *server_name = (char*)&packet->payload[offset+extension_offset]; while(begin < extension_len) { if((!ndpi_isprint(server_name[begin])) || ndpi_ispunct(server_name[begin]) || ndpi_isspace(server_name[begin])) begin++; else break; } len = (u_int)ndpi_min(extension_len-begin, buffer_len-1); strncpy(buffer, &server_name[begin], len); buffer[len] = '\0'; stripCertificateTrailer(buffer, buffer_len); snprintf(flow->protos.ssl.client_certificate, sizeof(flow->protos.ssl.client_certificate), "%s", buffer); /* We're happy now */ return(2 /* Client Certificate */); } extension_offset += extension_len; } } } } } } } } } return(0); /* Not found */ } int sslTryAndRetrieveServerCertificate(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* consider only specific SSL packets (handshake) */ if((packet->payload_packet_len > 9) && (packet->payload[0] == 0x16)) { char certificate[64]; int rc; certificate[0] = '\0'; rc = getSSLcertificate(ndpi_struct, flow, certificate, sizeof(certificate)); packet->ssl_certificate_num_checks++; if (rc > 0) { packet->ssl_certificate_detected++; if (flow->protos.ssl.server_certificate[0] != '\0') /* 0 means we're done processing extra packets (since we found what we wanted) */ return 0; } /* Client hello, Server Hello, and certificate packets probably all checked in this case */ if ((packet->ssl_certificate_num_checks >= 3) && (flow->l4.tcp.seen_syn) && (flow->l4.tcp.seen_syn_ack) && (flow->l4.tcp.seen_ack) /* We have seen the 3-way handshake */) { /* We're done processing extra packets since we've probably checked all possible cert packets */ return 0; } } /* 1 means keep looking for more packets */ return 1; } void sslInitExtraPacketProcessing(int caseNum, struct ndpi_flow_struct *flow) { flow->check_extra_packets = 1; /* 0 is the case for waiting for the server certificate */ if (caseNum == 0) { /* At most 7 packets should almost always be enough to find the server certificate if it's there */ flow->max_extra_packets_to_check = 7; flow->extra_packets_func = sslTryAndRetrieveServerCertificate; } } int sslDetectProtocolFromCertificate(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if((packet->payload_packet_len > 9) && (packet->payload[0] == 0x16 /* consider only specific SSL packets (handshake) */)) { if((packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) || (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL)) { char certificate[64]; int rc; certificate[0] = '\0'; rc = getSSLcertificate(ndpi_struct, flow, certificate, sizeof(certificate)); packet->ssl_certificate_num_checks++; if(rc > 0) { packet->ssl_certificate_detected++; #ifdef CERTIFICATE_DEBUG printf("***** [SSL] %s\n", certificate); #endif u_int32_t subproto = ndpi_match_host_subprotocol(ndpi_struct, flow, certificate, strlen(certificate), NDPI_PROTOCOL_SSL); if(subproto != NDPI_PROTOCOL_UNKNOWN) { /* If we've detected the subprotocol from client certificate but haven't had a chance * to see the server certificate yet, set up extra packet processing to wait * a few more packets. */ if((flow->protos.ssl.client_certificate[0] != '\0') && (flow->protos.ssl.server_certificate[0] == '\0')) { sslInitExtraPacketProcessing(0, flow); } ndpi_set_detected_protocol(ndpi_struct, flow, subproto, ndpi_ssl_refine_master_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SSL)); return(rc); /* Fix courtesy of Gianluca Costa */ } #ifdef NDPI_PROTOCOL_TOR if(ndpi_is_ssl_tor(ndpi_struct, flow, certificate) != 0) return(rc); #endif } if(((packet->ssl_certificate_num_checks >= 2) && flow->l4.tcp.seen_syn && flow->l4.tcp.seen_syn_ack && flow->l4.tcp.seen_ack /* We have seen the 3-way handshake */) || (flow->protos.ssl.server_certificate[0] != '\0') /* || (flow->protos.ssl.client_certificate[0] != '\0') */ ) { ndpi_int_ssl_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_SSL); } } } return(0); } static void ssl_mark_and_payload_search_for_other_protocols(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { #if defined(NDPI_PROTOCOL_TOR) || defined(NDPI_PROTOCOL_VPN_X) || defined(NDPI_PROTOCOL_UNENCRYPTED_JABBER) || defined (NDPI_PROTOCOL_OSCAR) || defined (NDPI_PROTOCOL_ITUNES) || defined (NDPI_PROTOCOL_GMAIL) struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=flow->src; // struct ndpi_id_struct *dst=flow->dst; u_int32_t a; u_int32_t end; #if defined(NDPI_PROTOCOL_UNENCRYPTED_JABBER) if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask, NDPI_PROTOCOL_UNENCRYPTED_JABBER) != 0) goto check_for_ssl_payload; #endif #if defined(NDPI_PROTOCOL_OSCAR) if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(ndpi_struct->detection_bitmask, NDPI_PROTOCOL_OSCAR) != 0) goto check_for_ssl_payload; #endif goto no_check_for_ssl_payload; check_for_ssl_payload: end = packet->payload_packet_len - 20; for (a = 5; a < end; a++) { #ifdef NDPI_PROTOCOL_UNENCRYPTED_JABBER if(packet->payload[a] == 't') { if(memcmp(&packet->payload[a], "talk.google.com", 15) == 0) { NDPI_LOG(NDPI_PROTOCOL_UNENCRYPTED_JABBER, ndpi_struct, NDPI_LOG_DEBUG, "ssl jabber packet match\n"); if(NDPI_COMPARE_PROTOCOL_TO_BITMASK (ndpi_struct->detection_bitmask, NDPI_PROTOCOL_UNENCRYPTED_JABBER) != 0) { ndpi_int_ssl_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_UNENCRYPTED_JABBER); return; } } } #endif #ifdef NDPI_PROTOCOL_OSCAR if(packet->payload[a] == 'A' || packet->payload[a] == 'k' || packet->payload[a] == 'c' || packet->payload[a] == 'h') { if(((a + 19) < packet->payload_packet_len && memcmp(&packet->payload[a], "America Online Inc.", 19) == 0) // || (end - c > 3 memcmp (&packet->payload[c],"AOL", 3) == 0 ) // || (end - c > 7 && memcmp (&packet->payload[c], "AOL LLC", 7) == 0) || ((a + 15) < packet->payload_packet_len && memcmp(&packet->payload[a], "kdc.uas.aol.com", 15) == 0) || ((a + 14) < packet->payload_packet_len && memcmp(&packet->payload[a], "corehc@aol.net", 14) == 0) || ((a + 41) < packet->payload_packet_len && memcmp(&packet->payload[a], "http://crl.aol.com/AOLMSPKI/aolServerCert", 41) == 0) || ((a + 28) < packet->payload_packet_len && memcmp(&packet->payload[a], "http://ocsp.web.aol.com/ocsp", 28) == 0) || ((a + 32) < packet->payload_packet_len && memcmp(&packet->payload[a], "http://pki-info.aol.com/AOLMSPKI", 32) == 0)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR SERVER SSL DETECTED\n"); if(flow->dst != NULL && packet->payload_packet_len > 75) { memcpy(flow->dst->oscar_ssl_session_id, &packet->payload[44], 32); flow->dst->oscar_ssl_session_id[32] = '\0'; flow->dst->oscar_last_safe_access_time = packet->tick_timestamp; } ndpi_int_ssl_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_OSCAR); return; } } if(packet->payload[a] == 'm' || packet->payload[a] == 's') { if((a + 21) < packet->payload_packet_len && (memcmp(&packet->payload[a], "my.screenname.aol.com", 21) == 0 || memcmp(&packet->payload[a], "sns-static.aolcdn.com", 21) == 0)) { NDPI_LOG(NDPI_PROTOCOL_OSCAR, ndpi_struct, NDPI_LOG_DEBUG, "OSCAR SERVER SSL DETECTED\n"); ndpi_int_ssl_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_OSCAR); return; } } #endif } no_check_for_ssl_payload: #endif if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "found ssl connection.\n"); sslDetectProtocolFromCertificate(ndpi_struct, flow); if(!packet->ssl_certificate_detected && (!(flow->l4.tcp.ssl_seen_client_cert && flow->l4.tcp.ssl_seen_server_cert))) { /* SSL without certificate (Skype, Ultrasurf?) */ ndpi_int_ssl_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_SSL_NO_CERT); } else ndpi_int_ssl_add_connection(ndpi_struct, flow, NDPI_PROTOCOL_SSL); } } static u_int8_t ndpi_search_sslv3_direction1(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // // struct ndpi_id_struct *src=flow->src; // struct ndpi_id_struct *dst=flow->dst; if((packet->payload_packet_len >= 5) && (packet->payload[0] == 0x16) && (packet->payload[1] == 0x03) && ((packet->payload[2] == 0x00) || (packet->payload[2] == 0x01) || (packet->payload[2] == 0x02) || (packet->payload[2] == 0x03) )) { u_int32_t temp; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "search sslv3\n"); // SSLv3 Record if(packet->payload_packet_len >= 1300) { return 1; } temp = ntohs(get_u_int16_t(packet->payload, 3)) + 5; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "temp = %u.\n", temp); if(packet->payload_packet_len == temp || (temp < packet->payload_packet_len && packet->payload_packet_len > 500)) { return 1; } if(packet->payload_packet_len < temp && temp < 5000 && packet->payload_packet_len > 9) { /* the server hello may be split into small packets */ u_int32_t cert_start; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "maybe SSLv3 server hello split into smaller packets\n"); /* lets hope at least the server hello and the start of the certificate block are in the first packet */ cert_start = ntohs(get_u_int16_t(packet->payload, 7)) + 5 + 4; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "suspected start of certificate: %u\n", cert_start); if(cert_start < packet->payload_packet_len && packet->payload[cert_start] == 0x0b) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "found 0x0b at suspected start of certificate block\n"); return 2; } } if((packet->payload_packet_len > temp && packet->payload_packet_len > 100) && packet->payload_packet_len > 9) { /* the server hello may be split into small packets and the certificate has its own SSL Record * so temp contains only the length for the first ServerHello block */ u_int32_t cert_start; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "maybe SSLv3 server hello split into smaller packets but with seperate record for the certificate\n"); /* lets hope at least the server hello record and the start of the certificate record are in the first packet */ cert_start = ntohs(get_u_int16_t(packet->payload, 7)) + 5 + 5 + 4; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "suspected start of certificate: %u\n", cert_start); if(cert_start < packet->payload_packet_len && packet->payload[cert_start] == 0x0b) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "found 0x0b at suspected start of certificate block\n"); return 2; } } if(packet->payload_packet_len >= temp + 5 && (packet->payload[temp] == 0x14 || packet->payload[temp] == 0x16) && packet->payload[temp + 1] == 0x03) { u_int32_t temp2 = ntohs(get_u_int16_t(packet->payload, temp + 3)) + 5; if(temp + temp2 > NDPI_MAX_SSL_REQUEST_SIZE) { return 1; } temp += temp2; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "temp = %u.\n", temp); if(packet->payload_packet_len == temp) { return 1; } if(packet->payload_packet_len >= temp + 5 && packet->payload[temp] == 0x16 && packet->payload[temp + 1] == 0x03) { temp2 = ntohs(get_u_int16_t(packet->payload, temp + 3)) + 5; if(temp + temp2 > NDPI_MAX_SSL_REQUEST_SIZE) { return 1; } temp += temp2; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "temp = %u.\n", temp); if(packet->payload_packet_len == temp) { return 1; } if(packet->payload_packet_len >= temp + 5 && packet->payload[temp] == 0x16 && packet->payload[temp + 1] == 0x03) { temp2 = ntohs(get_u_int16_t(packet->payload, temp + 3)) + 5; if(temp + temp2 > NDPI_MAX_SSL_REQUEST_SIZE) { return 1; } temp += temp2; NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "temp = %u.\n", temp); if(temp == packet->payload_packet_len) { return 1; } } } } } return 0; } void ndpi_search_ssl_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=flow->src; // struct ndpi_id_struct *dst=flow->dst; u_int8_t ret; if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) { if(flow->l4.tcp.ssl_stage == 3 && packet->payload_packet_len > 20 && flow->packet_counter < 5) { /* this should only happen, when we detected SSL with a packet that had parts of the certificate in subsequent packets * so go on checking for certificate patterns for a couple more packets */ NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "ssl flow but check another packet for patterns\n"); ssl_mark_and_payload_search_for_other_protocols(ndpi_struct, flow); if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) { /* still ssl so check another packet */ return; } else { /* protocol has changed so we are done */ return; } } return; } NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "search ssl\n"); { /* Check if this is whatsapp first (this proto runs over port 443) */ if((packet->payload_packet_len > 5) && ((packet->payload[0] == 'W') && (packet->payload[1] == 'A') && (packet->payload[4] == 0) && (packet->payload[2] <= 9) && (packet->payload[3] <= 9))) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN); return; } else if((packet->payload_packet_len == 4) && (packet->payload[0] == 'W') && (packet->payload[1] == 'A')) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHATSAPP, NDPI_PROTOCOL_UNKNOWN); return; } else { /* No whatsapp, let's try SSL */ if(sslDetectProtocolFromCertificate(ndpi_struct, flow) > 0) return; } } if(packet->payload_packet_len > 40 && flow->l4.tcp.ssl_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "first ssl packet\n"); // SSLv2 Record if(packet->payload[2] == 0x01 && packet->payload[3] == 0x03 && (packet->payload[4] == 0x00 || packet->payload[4] == 0x01 || packet->payload[4] == 0x02) && (packet->payload_packet_len - packet->payload[1] == 2)) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "sslv2 len match\n"); flow->l4.tcp.ssl_stage = 1 + packet->packet_direction; return; } if(packet->payload[0] == 0x16 && packet->payload[1] == 0x03 && (packet->payload[2] == 0x00 || packet->payload[2] == 0x01 || packet->payload[2] == 0x02) && (packet->payload_packet_len - ntohs(get_u_int16_t(packet->payload, 3)) == 5)) { // SSLv3 Record NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "sslv3 len match\n"); flow->l4.tcp.ssl_stage = 1 + packet->packet_direction; return; } } if(packet->payload_packet_len > 40 && flow->l4.tcp.ssl_stage == 1 + packet->packet_direction && flow->packet_direction_counter[packet->packet_direction] < 5) { return; } if(packet->payload_packet_len > 40 && flow->l4.tcp.ssl_stage == 2 - packet->packet_direction) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "second ssl packet\n"); // SSLv2 Record if(packet->payload[2] == 0x01 && packet->payload[3] == 0x03 && (packet->payload[4] == 0x00 || packet->payload[4] == 0x01 || packet->payload[4] == 0x02) && (packet->payload_packet_len - 2) >= packet->payload[1]) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "sslv2 server len match\n"); ssl_mark_and_payload_search_for_other_protocols(ndpi_struct, flow); return; } ret = ndpi_search_sslv3_direction1(ndpi_struct, flow); if(ret == 1) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "sslv3 server len match\n"); ssl_mark_and_payload_search_for_other_protocols(ndpi_struct, flow); return; } else if(ret == 2) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "sslv3 server len match with split packet -> check some more packets for SSL patterns\n"); ssl_mark_and_payload_search_for_other_protocols(ndpi_struct, flow); if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) { flow->l4.tcp.ssl_stage = 3; } return; } if(packet->payload_packet_len > 40 && flow->packet_direction_counter[packet->packet_direction] < 5) { NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "need next packet\n"); return; } } NDPI_LOG(NDPI_PROTOCOL_SSL, ndpi_struct, NDPI_LOG_DEBUG, "exclude ssl\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SSL); return; } void init_ssl_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("SSL", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SSL, ndpi_search_ssl_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/starcraft.c000066400000000000000000000133201321103654100176600ustar00rootroot00000000000000/* * starcraft.c * * Copyright (C) 2015 - Matteo Bracci * Copyright (C) 2015 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_STARCRAFT /* Sender or receiver are one of the known login portals? */ u_int8_t sc2_match_logon_ip(struct ndpi_packet_struct* packet) { if (packet->iph == NULL) return 0; u_int32_t source_ip = ntohl(packet->iph->saddr); u_int32_t dest_ip = ntohl(packet->iph->daddr); return (ndpi_ips_match(source_ip, dest_ip, 0xD5F87F82, 32) // EU 213.248.127.130 || ndpi_ips_match(source_ip, dest_ip, 0x0C81CE82, 32) // US 12.129.206.130 || ndpi_ips_match(source_ip, dest_ip, 0x79FEC882, 32) // KR 121.254.200.130 || ndpi_ips_match(source_ip, dest_ip, 0xCA09424C, 32) // SG 202.9.66.76 || ndpi_ips_match(source_ip, dest_ip, 0x0C81ECFE, 32)); // BETA 12.129.236.254 } /* The main TCP flow starts with the user login and stays alive until the logout. Although hard to read, judging from what happens elsewhere this flow probably contains all the data transfer generated by the user interaction with the client, e.g. chatting or looking at someone's match history. The current way to detect this is plain dumb packet matching. */ u_int8_t ndpi_check_starcraft_tcp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { if (sc2_match_logon_ip(&flow->packet) && flow->packet.tcp->dest == htons(1119) //bnetgame port && (ndpi_match_strprefix(flow->packet.payload, flow->packet.payload_packet_len, "\x4a\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66") || ndpi_match_strprefix(flow->packet.payload, flow->packet.payload_packet_len, "\x49\x00\x00\x0a\x66\x02\x0a\xed\x2d\x66"))) return 1; else return -1; } /* UPD traffic is the actual game data and it uses a port owned by Blizzard itself, 1119. Therefore the real key point here is to make sure that it's actually Starcraft 2 that is using the port and not some other Blizzard software. The flow is taken if a pattern in the size of some subsequent packets is found. */ u_int8_t ndpi_check_starcraft_udp(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { struct ndpi_packet_struct* packet = &flow->packet; /* First off, filter out any traffic not using port 1119, removing the chance of any false positive if we assume that non allowed protocols don't use the port */ if (packet->udp->source != htons(1119) && packet->udp->dest != htons(1119)) return -1; /* Then try to detect the size pattern */ switch (flow->starcraft_udp_stage) { case 0: if (packet->payload_packet_len == 20) flow->starcraft_udp_stage = 1; break; case 1: if (packet->payload_packet_len == 20) flow->starcraft_udp_stage = 2; break; case 2: if (packet->payload_packet_len == 75 || packet->payload_packet_len == 85) flow->starcraft_udp_stage = 3; break; case 3: if (packet->payload_packet_len == 20) flow->starcraft_udp_stage = 4; break; case 4: if (packet->payload_packet_len == 548) flow->starcraft_udp_stage = 5; break; case 5: if (packet->payload_packet_len == 548) flow->starcraft_udp_stage = 6; break; case 6: if (packet->payload_packet_len == 548) flow->starcraft_udp_stage = 7; break; case 7: if (packet->payload_packet_len == 484) return 1; break; } return(0); } void ndpi_search_starcraft(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft protocol detection...\n"); if (flow->packet.detected_protocol_stack[0] != NDPI_PROTOCOL_STARCRAFT) { struct ndpi_packet_struct* packet = &flow->packet; int8_t result = 0; if (packet->udp != NULL) { result = ndpi_check_starcraft_udp(ndpi_struct, flow); if (result == 1) { //printf("Found Starcraft 2 [Game, UDP]\n"); NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Game, UDP]\n"); } } else if (packet->tcp != NULL) { result = ndpi_check_starcraft_tcp(ndpi_struct, flow); if (result == 1) { //printf("Found Starcraft 2 [Client, TCP]\n"); NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Found Starcraft 2 [Client, TCP]\n"); } } if (result == 1) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STARCRAFT, NDPI_PROTOCOL_UNKNOWN); } else if (result == -1) { NDPI_LOG(NDPI_PROTOCOL_STARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Starcraft excluded\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STARCRAFT); } } } void init_starcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Starcraft", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_STARCRAFT, ndpi_search_starcraft, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/stealthnet.c000066400000000000000000000046151321103654100200510ustar00rootroot00000000000000/* * stealthnet.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_STEALTHNET static void ndpi_int_stealthnet_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STEALTHNET, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_stealthnet(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src = flow->src; // struct ndpi_id_struct *dst = flow->dst; if (packet->payload_packet_len > 40 && memcmp(packet->payload, "LARS REGENSBURGER'S FILE SHARING PROTOCOL", 41) == 0) { NDPI_LOG(NDPI_PROTOCOL_STEALTHNET, ndpi_struct, NDPI_LOG_DEBUG, "found stealthnet\n"); ndpi_int_stealthnet_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_STEALTHNET, ndpi_struct, NDPI_LOG_DEBUG, "exclude stealthnet.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STEALTHNET); } void init_stealthnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Stealthnet", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_STEALTHNET, ndpi_search_stealthnet, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/steam.c000066400000000000000000000333631321103654100170110ustar00rootroot00000000000000/* * steam.c * * Copyright (C) 2014 Tomasz Bujlow * * The signature is mostly based on the Libprotoident library * except the detection of HTTP Steam flows. * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_STEAM static void ndpi_int_steam_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_STEAM, NDPI_PROTOCOL_UNKNOWN); } static void ndpi_check_steam_http(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct, flow, packet); if (packet->user_agent_line.ptr != NULL && packet->user_agent_line.len >= 23 && memcmp(packet->user_agent_line.ptr, "Valve/Steam HTTP Client", 23) == 0) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); } } static void ndpi_check_steam_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if (flow->steam_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage 0: \n"); if ((payload_len == 1 && packet->payload[0] == 0x01) || ((payload_len == 4 || payload_len == 5) && ndpi_match_strprefix(packet->payload, payload_len, "\x01\x00\x00\x00"))) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Possible STEAM request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->steam_stage = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 return; } if ((payload_len == 1 && packet->payload[0] == 0x00) || ((payload_len == 4 || payload_len == 5) && ndpi_match_strprefix(packet->payload, payload_len, "\x00\x00\x00"))) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Possible STEAM request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->steam_stage = packet->packet_direction + 3; // packet_direction 0: stage 3, packet_direction 1: stage 4 return; } } else if ((flow->steam_stage == 1) || (flow->steam_stage == 2)) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage %u: \n", flow->steam_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->steam_stage - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 1 && packet->payload[0] == 0x00) || ((payload_len == 4 || payload_len == 5) && ndpi_match_strprefix(packet->payload, payload_len, "\x00\x00\x00"))) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to STEAM, resetting the stage to 0...\n"); flow->steam_stage = 0; } } else if ((flow->steam_stage == 3) || (flow->steam_stage == 4)) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage %u: \n", flow->steam_stage); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->steam_stage - packet->packet_direction) == 3) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 1 && packet->payload[0] == 0x01) || ((payload_len == 4 || payload_len == 5) && ndpi_match_strprefix(packet->payload, payload_len, "\x01\x00\x00\x00"))) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to STEAM, resetting the stage to 0...\n"); flow->steam_stage = 0; } } } static void ndpi_check_steam_udp1(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; if (ndpi_match_strprefix(packet->payload, payload_len, "VS01")) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); return; } /* Check if we so far detected the protocol in the request or not. */ if (flow->steam_stage1 == 0) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage 0: \n"); if (ndpi_match_strprefix(packet->payload, payload_len, "\x31\xff\x30\x2e")) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Possible STEAM request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->steam_stage1 = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 return; } if (ndpi_match_strprefix(packet->payload, payload_len, "\xff\xff\xff\xff")) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Possible STEAM request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->steam_stage1 = packet->packet_direction + 3; // packet_direction 0: stage 3, packet_direction 1: stage 4 return; } } else if ((flow->steam_stage1 == 1) || (flow->steam_stage1 == 2)) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage %u: \n", flow->steam_stage1); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->steam_stage1 - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if (ndpi_match_strprefix(packet->payload, payload_len, "\xff\xff\xff\xff")) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to STEAM, resetting the stage to 0...\n"); flow->steam_stage1 = 0; } } else if ((flow->steam_stage1 == 3) || (flow->steam_stage1 == 4)) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage %u: \n", flow->steam_stage1); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->steam_stage1 - packet->packet_direction) == 3) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if (ndpi_match_strprefix(packet->payload, payload_len, "\x31\xff\x30\x2e")) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to STEAM, resetting the stage to 0...\n"); flow->steam_stage1 = 0; } } } static void ndpi_check_steam_udp2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Check if we so far detected the protocol in the request or not. */ if (flow->steam_stage2 == 0) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage 0: \n"); if ((payload_len == 25) && ndpi_match_strprefix(packet->payload, payload_len, "\xff\xff\xff\xff")) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Possible STEAM request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->steam_stage2 = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 } } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage %u: \n", flow->steam_stage2); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->steam_stage2 - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 0) || ndpi_match_strprefix(packet->payload, payload_len, "\xff\xff\xff\xff")) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to STEAM, resetting the stage to 0...\n"); flow->steam_stage2 = 0; } } } static void ndpi_check_steam_udp3(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; /* Check if we so far detected the protocol in the request or not. */ if (flow->steam_stage3 == 0) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage 0: \n"); if ((payload_len == 4) && (packet->payload[0] == 0x39) && (packet->payload[1] == 0x18) && (packet->payload[2] == 0x00) && (packet->payload[3] == 0x00)) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Possible STEAM request detected, we will look further for the response...\n"); /* Encode the direction of the packet in the stage, so we will know when we need to look for the response packet. */ flow->steam_stage3 = packet->packet_direction + 1; // packet_direction 0: stage 1, packet_direction 1: stage 2 } } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM stage %u: \n", flow->steam_stage3); /* At first check, if this is for sure a response packet (in another direction. If not, do nothing now and return. */ if ((flow->steam_stage3 - packet->packet_direction) == 1) { return; } /* This is a packet in another direction. Check if we find the proper response. */ if ((payload_len == 0) || ((payload_len == 8) && (packet->payload[0] == 0x3a) && (packet->payload[1] == 0x18) && (packet->payload[2] == 0x00) && (packet->payload[3] == 0x00))) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Found STEAM.\n"); ndpi_int_steam_add_connection(ndpi_struct, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "The reply did not seem to belong to STEAM, resetting the stage to 0...\n"); flow->steam_stage3 = 0; } } } void ndpi_search_steam(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* Break after 20 packets. */ if (flow->packet_counter > 20) { NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "Exclude STEAM.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STEAM); return; } /* skip marked or retransmitted packets */ if (packet->tcp_retransmission != 0) { return; } if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) { return; } NDPI_LOG(NDPI_PROTOCOL_STEAM, ndpi_struct, NDPI_LOG_DEBUG, "STEAM detection...\n"); ndpi_check_steam_http(ndpi_struct, flow); if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) { return; } ndpi_check_steam_tcp(ndpi_struct, flow); if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) { return; } ndpi_check_steam_udp1(ndpi_struct, flow); if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) { return; } ndpi_check_steam_udp2(ndpi_struct, flow); if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_STEAM) { return; } ndpi_check_steam_udp3(ndpi_struct, flow); } void init_steam_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Steam", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_STEAM, ndpi_search_steam, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/stun.c000066400000000000000000000266131321103654100166710ustar00rootroot00000000000000/* * stun.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_STUN #define MAX_NUM_STUN_PKTS 10 struct stun_packet_header { u_int16_t msg_type, msg_len; u_int32_t cookie; u_int8_t transaction_id[8]; }; static void ndpi_int_stun_add_connection(struct ndpi_detection_module_struct *ndpi_struct, u_int proto, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, proto, NDPI_PROTOCOL_UNKNOWN); } typedef enum { NDPI_IS_STUN, NDPI_IS_NOT_STUN } ndpi_int_stun_t; static ndpi_int_stun_t ndpi_int_check_stun(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, const u_int8_t * payload, const u_int16_t payload_length, u_int8_t *is_whatsapp, u_int8_t *is_skype) { u_int16_t msg_type, msg_len; struct stun_packet_header *h = (struct stun_packet_header*)payload; u_int8_t can_this_be_whatsapp_voice = 1; if(payload_length < sizeof(struct stun_packet_header)) { if(flow->num_stun_udp_pkts > 0) { *is_whatsapp = 1; return NDPI_IS_STUN; /* This is WhatsApp Voice */ } else return(NDPI_IS_NOT_STUN); } if((strncmp((const char*)payload, (const char*)"RSP/", 4) == 0) && (strncmp((const char*)&payload[7], (const char*)" STUN_", 6) == 0)) { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "Found stun.\n"); goto udp_stun_found; } msg_type = ntohs(h->msg_type) & 0x3EEF, msg_len = ntohs(h->msg_len); if((payload[0] != 0x80) && ((msg_len+20) > payload_length)) return(NDPI_IS_NOT_STUN); if((payload_length == (msg_len+20)) && ((msg_type <= 0x000b) /* http://www.3cx.com/blog/voip-howto/stun-details/ */)) { u_int offset = 20; /* This can either be the standard RTCP or Ms Lync RTCP that later will become Ms Lync RTP. In this case we need to be careful before deciding about the protocol before dissecting the packet MS Lync = Skype https://en.wikipedia.org/wiki/Skype_for_Business */ while(offset < payload_length) { u_int16_t attribute = ntohs(*((u_int16_t*)&payload[offset])); u_int16_t len = ntohs(*((u_int16_t*)&payload[offset+2])); u_int16_t x = (len + 4) % 4; if(x != 0) len += 4-x; switch(attribute) { case 0x0008: /* Message Integrity */ case 0x0020: /* XOR-MAPPED-ADDRESSES */ case 0x4002: /* These are the only messages apparently whatsapp voice can use */ break; case 0x8054: /* Candidate Identifier */ if((len == 4) && (payload[offset+5] == 0x00) && (payload[offset+6] == 0x00) && (payload[offset+7] == 0x00)) { /* Either skype for business or "normal" skype with multiparty call */ *is_skype = 1; return(NDPI_IS_STUN); } break; case 0x8070: /* Implementation Version */ if((len == 4) && (payload[offset+4] == 0x00) && (payload[offset+5] == 0x00) && (payload[offset+6] == 0x00) && ((payload[offset+7] == 0x02) || (payload[offset+7] == 0x03)) ) { *is_skype = 1; return(NDPI_IS_STUN); } break; default: /* This means this STUN packet cannot be confused with whatsapp voice */ can_this_be_whatsapp_voice = 0; break; } offset += len + 4; } goto udp_stun_found; } #ifdef ORIGINAL_CODE /* * token list of message types and attribute types from * http://wwwbs1.informatik.htw-dresden.de/svortrag/i02/Schoene/stun/stun.html * the same list you can find in * https://summersoft.fay.ar.us/repos/ethereal/branches/redhat-9/ethereal-0.10.3-1/ethereal-0.10.3/packet-stun.c * token further message types and attributes from * http://www.freeswitch.org/docs/group__stun1.html * added further attributes observed * message types: 0x0001, 0x0101, 0x0111, 0x0002, 0x0102, 0x0112, 0x0003, 0x0103, 0x0004, 0x0104, 0x0114, 0x0115 * attribute types: 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0006, 0x0007, 0x0008, 0x0009, * 0x000a, 0x000b, 0c000c, 0x000d, 0x000e, 0x000f, 0x0010, 0x0011, 0x0012, 0x0013, 0x0014, 0x0015, 0x0020, * 0x0022, 0x0024, 0x8001, 0x8006, 0x8008, 0x8015, 0x8020, 0x8028, 0x802a, 0x8029, 0x8050, 0x8054, 0x8055 * * 0x8003, 0x8004 used by facetime */ if(payload_length >= 20 && ntohs(get_u_int16_t(payload, 2)) + 20 == payload_length && ((payload[0] == 0x00 && (payload[1] >= 0x01 && payload[1] <= 0x04)) || (payload[0] == 0x01 && ((payload[1] >= 0x01 && payload[1] <= 0x04) || (payload[1] >= 0x11 && payload[1] <= 0x15))))) { u_int8_t mod; u_int8_t old = 1; u_int8_t padding = 0; NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "len and type match.\n"); if(payload_length == 20) { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found stun.\n"); goto udp_stun_found; } a = 20; while (a < payload_length) { if(old && payload_length >= a + 4 && ((payload[a] == 0x00 && ((payload[a + 1] >= 0x01 && payload[a + 1] <= 0x16) || payload[a + 1] == 0x19 || payload[a + 1] == 0x20 || payload[a + 1] == 0x22 || payload[a + 1] == 0x24 || payload[a + 1] == 0x25)) || (payload[a] == 0x80 && (payload[a + 1] == 0x01 || payload[a + 1] == 0x03 || payload[a + 1] == 0x04 || payload[a + 1] == 0x06 || payload[a + 1] == 0x08 || payload[a + 1] == 0x15 || payload[a + 1] == 0x20 || payload[a + 1] == 0x22 || payload[a + 1] == 0x28 || payload[a + 1] == 0x2a || payload[a + 1] == 0x29 || payload[a + 1] == 0x50 || payload[a + 1] == 0x54 || payload[a + 1] == 0x55)))) { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "attribute match.\n"); a += ((payload[a + 2] << 8) + payload[a + 3] + 4); mod = a % 4; if(mod) { padding = 4 - mod; } if(a == payload_length || (padding && (a + padding) == payload_length)) { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found stun.\n"); goto udp_stun_found; } } else if(payload_length >= a + padding + 4 && ((payload[a + padding] == 0x00 && ((payload[a + 1 + padding] >= 0x01 && payload[a + 1 + padding] <= 0x16) || payload[a + 1 + padding] == 0x19 || payload[a + 1 + padding] == 0x20 || payload[a + 1 + padding] == 0x22 || payload[a + 1 + padding] == 0x24 || payload[a + 1 + padding] == 0x25)) || (payload[a + padding] == 0x80 && (payload[a + 1 + padding] == 0x01 || payload[a + 1 + padding] == 0x03 || payload[a + 1 + padding] == 0x04 || payload[a + 1 + padding] == 0x06 || payload[a + 1 + padding] == 0x08 || payload[a + 1 + padding] == 0x15 || payload[a + 1 + padding] == 0x20 || payload[a + 1 + padding] == 0x22 || payload[a + 1 + padding] == 0x28 || payload[a + 1 + padding] == 0x2a || payload[a + 1 + padding] == 0x29 || payload[a + 1 + padding] == 0x50 || payload[a + 1 + padding] == 0x54 || payload[a + 1 + padding] == 0x55)) || ((payload[a + padding] == 0x40) && (payload[a + padding + 1] == 0x00)) )) { if((payload[a + padding] == 0x40) && (payload[a + padding + 1] == 0x00)) goto udp_stun_found; NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "New STUN - attribute match.\n"); old = 0; a += ((payload[a + 2 + padding] << 8) + payload[a + 3 + padding] + 4); padding = 0; mod = a % 4; if(mod) { a += 4 - mod; } if(a == payload_length) { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found stun.\n"); goto udp_stun_found; } } else { break; } } } #endif if((flow->num_stun_udp_pkts > 0) && (msg_type <= 0x00FF)) { *is_whatsapp = 1; return NDPI_IS_STUN; /* This is WhatsApp Voice */ } else return NDPI_IS_NOT_STUN; udp_stun_found: if(can_this_be_whatsapp_voice) { flow->num_stun_udp_pkts++; return((flow->num_stun_udp_pkts < MAX_NUM_STUN_PKTS) ? NDPI_IS_NOT_STUN : NDPI_IS_STUN); } else { /* We cannot immediately say that this is STUN as there are other protocols like GoogleHangout that might be candidates, thus we set the guessed protocol to STUN */ flow->guessed_protocol_id = NDPI_PROTOCOL_STUN; return(NDPI_IS_NOT_STUN); } } void ndpi_search_stun(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int8_t is_whatsapp = 0, is_skype = 0; NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "search stun.\n"); if(packet->tcp) { /* STUN may be encapsulated in TCP packets */ if(packet->payload_packet_len >= 2 + 20 && ntohs(get_u_int16_t(packet->payload, 0)) + 2 == packet->payload_packet_len) { /* TODO there could be several STUN packets in a single TCP packet so maybe the detection could be * improved by checking only the STUN packet of given length */ if(ndpi_int_check_stun(ndpi_struct, flow, packet->payload + 2, packet->payload_packet_len - 2, &is_whatsapp, &is_skype) == NDPI_IS_STUN) { if(is_skype) { NDPI_LOG(NDPI_PROTOCOL_SKYPE, ndpi_struct, NDPI_LOG_DEBUG, "Found Skype\n"); ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_SKYPE, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found UDP stun.\n"); ndpi_int_stun_add_connection(ndpi_struct, is_whatsapp ? NDPI_PROTOCOL_WHATSAPP_VOICE : NDPI_PROTOCOL_STUN, flow); } return; } } } if(ndpi_int_check_stun(ndpi_struct, flow, packet->payload, packet->payload_packet_len, &is_whatsapp, &is_skype) == NDPI_IS_STUN) { if(is_skype) { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "Found Skype\n"); ndpi_int_stun_add_connection(ndpi_struct, NDPI_PROTOCOL_SKYPE, flow); } else { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "found UDP stun.\n"); ndpi_int_stun_add_connection(ndpi_struct, is_whatsapp ? NDPI_PROTOCOL_WHATSAPP_VOICE : NDPI_PROTOCOL_STUN, flow); } return; } if(flow->num_stun_udp_pkts >= MAX_NUM_STUN_PKTS) { NDPI_LOG(NDPI_PROTOCOL_STUN, ndpi_struct, NDPI_LOG_DEBUG, "exclude stun.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_STUN); } if(flow->packet_counter > 0) { /* This might be a RTP stream: let's make sure we check it */ NDPI_CLR(&flow->excluded_protocol_bitmask, NDPI_PROTOCOL_RTP); } } void init_stun_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("STUN", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_STUN, ndpi_search_stun, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/syslog.c000066400000000000000000000120231321103654100172060ustar00rootroot00000000000000/* * syslog.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_SYSLOG static void ndpi_int_syslog_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_SYSLOG, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_syslog(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int8_t i; NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "search syslog\n"); if (packet->payload_packet_len > 20 && packet->payload_packet_len <= 1024 && packet->payload[0] == '<') { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "checked len>20 and <1024 and first symbol=<.\n"); for (i = 1; i <= 3; i++) { if (packet->payload[i] < '0' || packet->payload[i] > '9') { break; } } NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "read symbols while the symbol is a number.\n"); if (packet->payload[i++] != '>') { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "there is no > following the number.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SYSLOG); return; } else { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "a > following the number.\n"); } if (packet->payload[i] == 0x20) { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "a blank following the >: increment i.\n"); i++; } else { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "no blank following the >: do nothing.\n"); } /* check for "last message repeated" */ if (i + sizeof("last message") - 1 <= packet->payload_packet_len && memcmp(packet->payload + i, "last message", sizeof("last message") - 1) == 0) { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "found syslog by 'last message' string.\n"); ndpi_int_syslog_add_connection(ndpi_struct, flow); return; } else if (i + sizeof("snort: ") - 1 <= packet->payload_packet_len && memcmp(packet->payload + i, "snort: ", sizeof("snort: ") - 1) == 0) { /* snort events */ NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "found syslog by 'snort: ' string.\n"); ndpi_int_syslog_add_connection(ndpi_struct, flow); return; } if (memcmp(&packet->payload[i], "Jan", 3) != 0 && memcmp(&packet->payload[i], "Feb", 3) != 0 && memcmp(&packet->payload[i], "Mar", 3) != 0 && memcmp(&packet->payload[i], "Apr", 3) != 0 && memcmp(&packet->payload[i], "May", 3) != 0 && memcmp(&packet->payload[i], "Jun", 3) != 0 && memcmp(&packet->payload[i], "Jul", 3) != 0 && memcmp(&packet->payload[i], "Aug", 3) != 0 && memcmp(&packet->payload[i], "Sep", 3) != 0 && memcmp(&packet->payload[i], "Oct", 3) != 0 && memcmp(&packet->payload[i], "Nov", 3) != 0 && memcmp(&packet->payload[i], "Dec", 3) != 0) { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "no month-shortname following: syslog excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SYSLOG); return; } else { NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "a month-shortname following: syslog detected.\n"); ndpi_int_syslog_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_SYSLOG, ndpi_struct, NDPI_LOG_DEBUG, "no syslog detected.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SYSLOG); } void init_syslog_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Syslog", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_SYSLOG, ndpi_search_syslog, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/tcp_udp.c000066400000000000000000000053561321103654100173370ustar00rootroot00000000000000/* * tcp_or_udp.c * * Copyright (C) 2011-15 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" /* ndpi_main.c */ extern u_int8_t ndpi_is_tor_flow(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow); u_int ndpi_search_tcp_or_udp_raw(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, u_int8_t protocol, u_int32_t saddr, u_int32_t daddr, /* host endianess */ u_int16_t sport, u_int16_t dport) /* host endianess */ { u_int16_t rc; struct in_addr host; if(protocol == IPPROTO_UDP) { if((sport == dport) && (sport == 17500)) { return(NDPI_PROTOCOL_DROPBOX); } } if(flow) return(flow->guessed_host_protocol_id); else { host.s_addr = htonl(saddr); if((rc = ndpi_network_ptree_match(ndpi_struct, &host)) != NDPI_PROTOCOL_UNKNOWN) return (rc); host.s_addr = htonl(daddr); return (ndpi_network_ptree_match(ndpi_struct, &host)); } } void ndpi_search_tcp_or_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { u_int16_t sport, dport; u_int proto; struct ndpi_packet_struct *packet = &flow->packet; if(flow->host_server_name[0] != '\0') return; if(ndpi_is_tor_flow(ndpi_struct, flow)) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TOR, NDPI_PROTOCOL_UNKNOWN); return; } if(packet->udp) sport = ntohs(packet->udp->source), dport = ntohs(packet->udp->dest); else if(packet->tcp) sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest); else sport = dport = 0; if(packet->iph /* IPv4 Only: we need to support packet->iphv6 at some point */) { proto = ndpi_search_tcp_or_udp_raw(ndpi_struct, flow, flow->packet.iph ? flow->packet.iph->protocol : #ifdef NDPI_DETECTION_SUPPORT_IPV6 flow->packet.iphv6->ip6_ctlun.ip6_un1.ip6_un1_nxt, #else 0, #endif ntohl(packet->iph->saddr), ntohl(packet->iph->daddr), sport, dport); if(proto != NDPI_PROTOCOL_UNKNOWN) ndpi_set_detected_protocol(ndpi_struct, flow, proto, NDPI_PROTOCOL_UNKNOWN); } } nDPI-2.2/src/lib/protocols/teamspeak.c000066400000000000000000000063421321103654100176470ustar00rootroot00000000000000/* * teamspeak.c * * Copyright (C) 2013 Remy Mudingay * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_TEAMSPEAK static void ndpi_int_teamspeak_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TEAMSPEAK, NDPI_PROTOCOL_UNKNOWN); } u_int16_t tdport = 0, tsport = 0; u_int16_t udport = 0, usport = 0; void ndpi_search_teamspeak(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if (packet->udp != NULL) { usport = ntohs(packet->udp->source), udport = ntohs(packet->udp->dest); /* http://www.imfirewall.com/en/protocols/teamSpeak.htm */ if (((usport == 9987 || udport == 9987) || (usport == 8767 || udport == 8767)) && packet->payload_packet_len >= 20) { NDPI_LOG(NDPI_PROTOCOL_TEAMSPEAK, ndpi_struct, NDPI_LOG_DEBUG, "found TEAMSPEAK udp.\n"); ndpi_int_teamspeak_add_connection(ndpi_struct, flow); } } else if (packet->tcp != NULL) { tsport = ntohs(packet->tcp->source), tdport = ntohs(packet->tcp->dest); /* https://github.com/Youx/soliloque-server/wiki/Connection-packet */ if(packet->payload_packet_len >= 20) { if (((memcmp(packet->payload, "\xf4\xbe\x03\x00", 4) == 0)) || ((memcmp(packet->payload, "\xf4\xbe\x02\x00", 4) == 0)) || ((memcmp(packet->payload, "\xf4\xbe\x01\x00", 4) == 0))) { NDPI_LOG(NDPI_PROTOCOL_TEAMSPEAK, ndpi_struct, NDPI_LOG_DEBUG, "found TEAMSPEAK tcp.\n"); ndpi_int_teamspeak_add_connection(ndpi_struct, flow); } /* http://www.imfirewall.com/en/protocols/teamSpeak.htm */ } else if ((tsport == 14534 || tdport == 14534) || (tsport == 51234 || tdport == 51234)) { NDPI_LOG(NDPI_PROTOCOL_TEAMSPEAK, ndpi_struct, NDPI_LOG_DEBUG, "found TEAMSPEAK.\n"); ndpi_int_teamspeak_add_connection(ndpi_struct, flow); } } NDPI_LOG(NDPI_PROTOCOL_TEAMSPEAK, ndpi_struct, NDPI_LOG_DEBUG, "TEAMSPEAK excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TEAMSPEAK); return; } void init_teamspeak_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("TeamSpeak", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TEAMSPEAK, ndpi_search_teamspeak, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/teamviewer.c000066400000000000000000000076111321103654100200450ustar00rootroot00000000000000/* * teamviewer.c * * Copyright (C) 2012 by Gianluca Costa xplico.org * Copyright (C) 2012-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_TEAMVIEWER static void ndpi_int_teamview_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TEAMVIEWER, NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_TEAMVIEWER, ndpi_struct, NDPI_LOG_TRACE, "TEAMWIEWER Found.\n"); } void ndpi_search_teamview(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_TEAMVIEWER, ndpi_struct, NDPI_LOG_TRACE, "TEAMWIEWER detection...\n"); /* TeamViewer 178.77.120.0/25 http://myip.ms/view/ip_owners/144885/Teamviewer_Gmbh.html */ if(flow->packet.iph) { u_int32_t src = ntohl(flow->packet.iph->saddr); u_int32_t dst = ntohl(flow->packet.iph->daddr); /* 95.211.37.195 - 95.211.37.203 */ if(((src >= 1607673283) && (src <= 1607673291)) || ((dst >= 1607673283) && (dst <= 1607673291)) || ((src & 0xFFFFFF80 /* 255.255.255.128 */) == 0xB24D7800 /* 178.77.120.0 */) || ((dst & 0xFFFFFF80 /* 255.255.255.128 */) == 0xB24D7800 /* 178.77.120.0 */) ) { ndpi_int_teamview_add_connection(ndpi_struct, flow); return; } } if(packet->payload_packet_len == 0) return; if (packet->udp != NULL) { if (packet->payload_packet_len > 13) { if (packet->payload[0] == 0x00 && packet->payload[11] == 0x17 && packet->payload[12] == 0x24) { /* byte 0 is a counter/seq number, and at the start is 0 */ flow->l4.udp.teamviewer_stage++; if (flow->l4.udp.teamviewer_stage == 4 || packet->udp->dest == ntohs(5938) || packet->udp->source == ntohs(5938)) { ndpi_int_teamview_add_connection(ndpi_struct, flow); } return; } } } else if(packet->tcp != NULL) { if (packet->payload_packet_len > 2) { if (packet->payload[0] == 0x17 && packet->payload[1] == 0x24) { flow->l4.udp.teamviewer_stage++; if (flow->l4.udp.teamviewer_stage == 4 || packet->tcp->dest == ntohs(5938) || packet->tcp->source == ntohs(5938)) { ndpi_int_teamview_add_connection(ndpi_struct, flow); } return; } else if (flow->l4.udp.teamviewer_stage) { if (packet->payload[0] == 0x11 && packet->payload[1] == 0x30) { flow->l4.udp.teamviewer_stage++; if (flow->l4.udp.teamviewer_stage == 4) ndpi_int_teamview_add_connection(ndpi_struct, flow); } return; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TEAMVIEWER); } void init_teamviewer_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("TeamViewer", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TEAMVIEWER, ndpi_search_teamview, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/telegram.c000066400000000000000000000053311321103654100174720ustar00rootroot00000000000000/* * telegram.c * * Copyright (C) 2014 by Gianluca Costa xplico.org * Copyright (C) 2012-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_TELEGRAM static void ndpi_int_telegram_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TELEGRAM, NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_TELEGRAM, ndpi_struct, NDPI_LOG_TRACE, "TELEGRAM Found.\n"); } void ndpi_search_telegram(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport /* , sport */; NDPI_LOG(NDPI_PROTOCOL_TELEGRAM, ndpi_struct, NDPI_LOG_TRACE, "TELEGRAM detection...\n"); if (packet->payload_packet_len == 0) return; if (packet->tcp != NULL) { if (packet->payload_packet_len > 56) { dport = ntohs(packet->tcp->dest); /* sport = ntohs(packet->tcp->source); */ if (packet->payload[0] == 0xef && ( dport == 443 || dport == 80 || dport == 25 )) { if (packet->payload[1] == 0x7f) { ndpi_int_telegram_add_connection(ndpi_struct, flow); } else if (packet->payload[1]*4 <= packet->payload_packet_len - 1) { ndpi_int_telegram_add_connection(ndpi_struct, flow); } return; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TELEGRAM); } void init_telegram_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Telegram", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TELEGRAM, ndpi_search_telegram, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/telnet.c000066400000000000000000000074641321103654100171760ustar00rootroot00000000000000/* * telnet.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_TELNET static void ndpi_int_telnet_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TELNET, NDPI_PROTOCOL_UNKNOWN); } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t search_iac(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t a; if (packet->payload_packet_len < 3) { return 0; } if (!(packet->payload[0] == 0xff && packet->payload[1] > 0xf9 && packet->payload[1] != 0xff && packet->payload[2] < 0x28)) { return 0; } a = 3; while (a < packet->payload_packet_len - 2) { // commands start with a 0xff byte followed by a command byte >= 0xf0 and < 0xff // command bytes 0xfb to 0xfe are followed by an option byte <= 0x28 if (!(packet->payload[a] != 0xff || (packet->payload[a] == 0xff && (packet->payload[a + 1] >= 0xf0) && (packet->payload[a + 1] <= 0xfa)) || (packet->payload[a] == 0xff && (packet->payload[a + 1] >= 0xfb) && (packet->payload[a + 1] != 0xff) && (packet->payload[a + 2] <= 0x28)))) { return 0; } a++; } return 1; } /* this detection also works asymmetrically */ void ndpi_search_telnet_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { // struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_TELNET, ndpi_struct, NDPI_LOG_DEBUG, "search telnet.\n"); if (search_iac(ndpi_struct, flow) == 1) { if (flow->l4.tcp.telnet_stage == 2) { NDPI_LOG(NDPI_PROTOCOL_TELNET, ndpi_struct, NDPI_LOG_DEBUG, "telnet identified.\n"); ndpi_int_telnet_add_connection(ndpi_struct, flow); return; } flow->l4.tcp.telnet_stage++; NDPI_LOG(NDPI_PROTOCOL_TELNET, ndpi_struct, NDPI_LOG_DEBUG, "telnet stage %u.\n", flow->l4.tcp.telnet_stage); return; } if ((flow->packet_counter < 12 && flow->l4.tcp.telnet_stage > 0) || flow->packet_counter < 6) { return; } else { NDPI_LOG(NDPI_PROTOCOL_TELNET, ndpi_struct, NDPI_LOG_DEBUG, "telnet excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TELNET); } return; } void init_telnet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Telnet", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TELNET, ndpi_search_telnet_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/teredo.c000066400000000000000000000035471321103654100171630ustar00rootroot00000000000000/* * teredo.c * * Copyright (C) 2015 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_TEREDO /* https://en.wikipedia.org/wiki/Teredo_tunneling */ void ndpi_search_teredo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->udp && packet->iph && ((ntohl(packet->iph->daddr) & 0xF0000000) == 0xE0000000 /* A multicast address */) && ((ntohs(packet->udp->source) == 3544) || (ntohs(packet->udp->dest) == 3544)) && (packet->payload_packet_len >= 40 /* IPv6 header */)) ndpi_int_change_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TEREDO, NDPI_PROTOCOL_UNKNOWN); else NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TEREDO); } void init_teredo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("TEREDO", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TEREDO, ndpi_search_teredo, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/tftp.c000066400000000000000000000055711321103654100166550ustar00rootroot00000000000000/* * tftp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_TFTP static void ndpi_int_tftp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TFTP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_tftp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_TFTP, ndpi_struct, NDPI_LOG_DEBUG, "search TFTP.\n"); if (packet->payload_packet_len > 3 && flow->l4.udp.tftp_stage == 0 && ntohl(get_u_int32_t(packet->payload, 0)) == 0x00030001) { NDPI_LOG(NDPI_PROTOCOL_TFTP, ndpi_struct, NDPI_LOG_DEBUG, "maybe tftp. need next packet.\n"); flow->l4.udp.tftp_stage = 1; return; } if (packet->payload_packet_len > 3 && (flow->l4.udp.tftp_stage == 1) && ntohl(get_u_int32_t(packet->payload, 0)) == 0x00040001) { NDPI_LOG(NDPI_PROTOCOL_TFTP, ndpi_struct, NDPI_LOG_DEBUG, "found tftp.\n"); ndpi_int_tftp_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len > 1 && ((packet->payload[0] == 0 && packet->payload[packet->payload_packet_len - 1] == 0) || (packet->payload_packet_len == 4 && ntohl(get_u_int32_t(packet->payload, 0)) == 0x00040000))) { NDPI_LOG(NDPI_PROTOCOL_TFTP, ndpi_struct, NDPI_LOG_DEBUG, "skip initial packet.\n"); return; } NDPI_LOG(NDPI_PROTOCOL_TFTP, ndpi_struct, NDPI_LOG_DEBUG, "exclude TFTP.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TFTP); } void init_tftp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("TFTP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TFTP, ndpi_search_tftp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/thunder.c000066400000000000000000000204211321103654100173400ustar00rootroot00000000000000/* * thunder.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_THUNDER static void ndpi_int_thunder_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , ndpi_protocol_type_t protocol_type */) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_THUNDER, NDPI_PROTOCOL_UNKNOWN); if (src != NULL) { src->thunder_ts = packet->tick_timestamp; } if (dst != NULL) { dst->thunder_ts = packet->tick_timestamp; } } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif void ndpi_int_search_thunder_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30 && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) { if (flow->thunder_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "THUNDER udp detected\n"); ndpi_int_thunder_add_connection(ndpi_struct, flow); return; } flow->thunder_stage++; NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "maybe thunder udp packet detected, stage increased to %u\n", flow->thunder_stage); return; } NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "excluding thunder udp at stage %u\n", flow->thunder_stage); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER); } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif void ndpi_int_search_thunder_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; if (packet->payload_packet_len > 8 && packet->payload[0] >= 0x30 && packet->payload[0] < 0x40 && packet->payload[1] == 0 && packet->payload[2] == 0 && packet->payload[3] == 0) { if (flow->thunder_stage == 3) { NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "THUNDER tcp detected\n"); ndpi_int_thunder_add_connection(ndpi_struct, flow); return; } flow->thunder_stage++; NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "maybe thunder tcp packet detected, stage increased to %u\n", flow->thunder_stage); return; } if (flow->thunder_stage == 0 && packet->payload_packet_len > 17 && memcmp(packet->payload, "POST / HTTP/1.1\r\n", 17) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "maybe thunder http POST packet detected, parsed packet lines: %u, empty line set %u (at: %u)\n", packet->parsed_lines, packet->empty_line_position_set, packet->empty_line_position); if (packet->empty_line_position_set != 0 && packet->content_line.ptr != NULL && packet->content_line.len == 24 && memcmp(packet->content_line.ptr, "application/octet-stream", 24) == 0 && packet->empty_line_position_set < (packet->payload_packet_len - 8) && packet->payload[packet->empty_line_position + 2] >= 0x30 && packet->payload[packet->empty_line_position + 2] < 0x40 && packet->payload[packet->empty_line_position + 3] == 0x00 && packet->payload[packet->empty_line_position + 4] == 0x00 && packet->payload[packet->empty_line_position + 5] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "maybe thunder http POST packet application does match\n"); ndpi_int_thunder_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "excluding thunder tcp at stage %u\n", flow->thunder_stage); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_THUNDER); } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif void ndpi_int_search_thunder_http(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; if (packet->detected_protocol_stack[0] == NDPI_PROTOCOL_THUNDER) { if (src != NULL && ((u_int32_t) (packet->tick_timestamp - src->thunder_ts) < ndpi_struct->thunder_timeout)) { NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "thunder : save src connection packet detected\n"); src->thunder_ts = packet->tick_timestamp; } else if (dst != NULL && ((u_int32_t) (packet->tick_timestamp - dst->thunder_ts) < ndpi_struct->thunder_timeout)) { NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "thunder : save dst connection packet detected\n"); dst->thunder_ts = packet->tick_timestamp; } return; } if (packet->payload_packet_len > 5 && memcmp(packet->payload, "GET /", 5) == 0 && NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_THUNDER)) { NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "HTTP packet detected.\n"); ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->parsed_lines > 7 && packet->parsed_lines < 11 && packet->line[1].len > 10 && memcmp(packet->line[1].ptr, "Accept: */*", 11) == 0 && packet->line[2].len > 22 && memcmp(packet->line[2].ptr, "Cache-Control: no-cache", 23) == 0 && packet->line[3].len > 16 && memcmp(packet->line[3].ptr, "Connection: close", 17) == 0 && packet->line[4].len > 6 && memcmp(packet->line[4].ptr, "Host: ", 6) == 0 && packet->line[5].len > 15 && memcmp(packet->line[5].ptr, "Pragma: no-cache", 16) == 0 && packet->user_agent_line.ptr != NULL && packet->user_agent_line.len > 49 && memcmp(packet->user_agent_line.ptr, "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)", 50) == 0) { NDPI_LOG(NDPI_PROTOCOL_THUNDER, ndpi_struct, NDPI_LOG_DEBUG, "Thunder HTTP download detected, adding flow.\n"); ndpi_int_thunder_add_connection(ndpi_struct, flow); } } } void ndpi_search_thunder(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // //struct ndpi_id_struct *src = flow->src; //struct ndpi_id_struct *dst = flow->dst; if (packet->tcp != NULL) { ndpi_int_search_thunder_http(ndpi_struct, flow); ndpi_int_search_thunder_tcp(ndpi_struct, flow); } else if (packet->udp != NULL) { ndpi_int_search_thunder_udp(ndpi_struct, flow); } } void init_thunder_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Thunder", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_THUNDER, ndpi_search_thunder, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/tinc.c000066400000000000000000000116411321103654100166300ustar00rootroot00000000000000/* * tinc.c * * Copyright (C) 2017 - William Guglielmo * Copyright (C) 2017 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_TINC static void ndpi_check_tinc(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; const u_int8_t *packet_payload = packet->payload; u_int32_t payload_len = packet->payload_packet_len; if(packet->udp != NULL) { if(ndpi_struct->tinc_cache != NULL) { struct tinc_cache_entry tinc_cache_entry1 = { .src_address = packet->iph->saddr, .dst_address = packet->iph->daddr, .dst_port = packet->udp->dest }; struct tinc_cache_entry tinc_cache_entry2 = { .src_address = packet->iph->daddr, .dst_address = packet->iph->saddr, .dst_port = packet->udp->source }; if(cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry1, sizeof(tinc_cache_entry1)) == CACHE_NO_ERROR || cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry2, sizeof(tinc_cache_entry2)) == CACHE_NO_ERROR) { cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry1, sizeof(tinc_cache_entry1)); cache_remove(ndpi_struct->tinc_cache, &tinc_cache_entry2, sizeof(tinc_cache_entry2)); /* cache_free(ndpi_struct->tinc_cache); */ NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "Found tinc udp connection\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TINC, NDPI_PROTOCOL_UNKNOWN); } } return; } else if(packet->tcp != NULL) { if(payload_len == 0) { if(packet->tcp->syn == 1 && packet->tcp->ack == 0) { flow->tinc_cache_entry.src_address = packet->iph->saddr; flow->tinc_cache_entry.dst_address = packet->iph->daddr; flow->tinc_cache_entry.dst_port = packet->tcp->dest; } return; } switch(flow->tinc_state) { case 0: case 1: if(payload_len > 6 && memcmp(packet_payload, "0 ", 2) == 0 && packet_payload[2] != ' ') { u_int16_t i = 3; while(i < payload_len && packet_payload[i++] != ' '); if(i+3 == payload_len && memcmp((packet_payload+i), "17\n", 3) == 0) { flow->tinc_state++; return; } } break; case 2: case 3: if(payload_len > 11 && memcmp(packet_payload, "1 ", 2) == 0 && packet_payload[2] != ' ') { u_int16_t i = 3; u_int8_t numbers_left = 4; while(numbers_left) { while(packet_payload[i] >= '0' && packet_payload[i] <= '9') { i++; } if(packet_payload[i++] == ' ') { numbers_left--; } else break; } if(numbers_left) break; while((packet_payload[i] >= '0' && packet_payload[i] <= '9') || (packet_payload[i] >= 'A' && packet_payload[i] <= 'Z')) { i++; } if(packet_payload[i] == '\n') { if(++flow->tinc_state > 3) { if(ndpi_struct->tinc_cache == NULL) ndpi_struct->tinc_cache = cache_new(TINC_CACHE_MAX_SIZE); cache_add(ndpi_struct->tinc_cache, &(flow->tinc_cache_entry), sizeof(flow->tinc_cache_entry)); NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "Found tinc tcp connection\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TINC, NDPI_PROTOCOL_UNKNOWN); } return; } } break; default: break; } } NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "exclude tinc.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TINC); } void ndpi_search_tinc(struct ndpi_detection_module_struct* ndpi_struct, struct ndpi_flow_struct* flow) { struct ndpi_packet_struct* packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_TINC, ndpi_struct, NDPI_LOG_DEBUG, "tinc detection...\n"); if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_TINC) { if(packet->tcp_retransmission == 0) { ndpi_check_tinc(ndpi_struct, flow); } } } void init_tinc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("TINC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TINC, ndpi_search_tinc, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/tor.c000066400000000000000000000073411321103654100165010ustar00rootroot00000000000000/* * tor.c * * Copyright (C) 2016 ntop.org * Copyright (C) 2013 Remy Mudingay * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_TOR static void ndpi_int_tor_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TOR, NDPI_PROTOCOL_UNKNOWN); } int ndpi_is_ssl_tor(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow, char *certificate) { int prev_num = 0, numbers_found = 0, num_found = 0, i, len; char dummy[48], *dot, *name; if(certificate == NULL) return(0); else len = strlen(certificate); /* Check if it ends in .com or .net */ if(strcmp(&certificate[len-4], ".com") && strcmp(&certificate[len-4], ".net")) return(0); if((len < 6) || (!strncmp(certificate, "*.", 2)) /* Wildcard certificate */ || (strncmp(certificate, "www.", 4)) /* Not starting with www.... */ ) return(0); // printf("***** [SSL] %s(): %s\n", __FUNCTION__, certificate); snprintf(dummy, sizeof(dummy), "%s", certificate); if((dot = strrchr(dummy, '.')) == NULL) return(0); dot[0] = '\0'; if((dot = strrchr(dummy, '.')) == NULL) return(0); name = &dot[1]; len = strlen(name); if(len >= 5) { for(i = 0; name[i+1] != '\0'; i++) { // printf("***** [SSL] %s(): [%d][%c]", __FUNCTION__, i, name[i]); if((name[i] >= '0') && (name[i] <= '9')) { if(prev_num != 1) { numbers_found++; if(numbers_found == 2) { ndpi_int_tor_add_connection(ndpi_struct, flow); return(1); } prev_num = 1; } } else prev_num = 0; if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->bigrams_automa, &name[i])) { num_found++; } else if(ndpi_match_bigram(ndpi_struct, &ndpi_struct->impossible_bigrams_automa, &name[i])) { ndpi_int_tor_add_connection(ndpi_struct, flow); return(1); } } if(num_found == 0) { ndpi_int_tor_add_connection(ndpi_struct, flow); return(1); } else { #ifdef PEDANTIC_TOR_CHECK if(gethostbyname(certificate) == NULL) { ndpi_int_tor_add_connection(ndpi_struct, flow); return(1); } #endif } } return(0); } /* ******************************************* */ void ndpi_search_tor(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int16_t dport = 0, sport = 0; NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "search for TOR.\n"); if(packet->tcp != NULL) { sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest); NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "calculating TOR over tcp.\n"); if ((((dport == 9001) || (sport == 9001)) || ((dport == 9030) || (sport == 9030))) && ((packet->payload[0] == 0x17) || (packet->payload[0] == 0x16)) && (packet->payload[1] == 0x03) && (packet->payload[2] == 0x01) && (packet->payload[3] == 0x00)) { NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "found tor.\n"); ndpi_int_tor_add_connection(ndpi_struct, flow); } } else { NDPI_LOG(NDPI_PROTOCOL_TOR, ndpi_struct, NDPI_LOG_DEBUG, "exclude TOR.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TOR); } } void init_tor_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Tor", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TOR, ndpi_search_tor, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/tvants.c000066400000000000000000000066611321103654100172200ustar00rootroot00000000000000/* * tvants.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_TVANTS static void ndpi_int_tvants_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TVANTS, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_tvants_udp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_TVANTS, ndpi_struct, NDPI_LOG_DEBUG, "search tvants. \n"); if (packet->udp != NULL && packet->payload_packet_len > 57 && packet->payload[0] == 0x04 && packet->payload[1] == 0x00 && (packet->payload[2] == 0x05 || packet->payload[2] == 0x06 || packet->payload[2] == 0x07) && packet->payload[3] == 0x00 && packet->payload_packet_len == (packet->payload[5] << 8) + packet->payload[4] && packet->payload[6] == 0x00 && packet->payload[7] == 0x00 && (memcmp(&packet->payload[48], "TVANTS", 6) == 0 || memcmp(&packet->payload[49], "TVANTS", 6) == 0 || memcmp(&packet->payload[51], "TVANTS", 6) == 0)) { NDPI_LOG(NDPI_PROTOCOL_TVANTS, ndpi_struct, NDPI_LOG_DEBUG, "found tvants over udp. \n"); ndpi_int_tvants_add_connection(ndpi_struct, flow); } else if (packet->tcp != NULL && packet->payload_packet_len > 15 && packet->payload[0] == 0x04 && packet->payload[1] == 0x00 && packet->payload[2] == 0x07 && packet->payload[3] == 0x00 && packet->payload_packet_len == (packet->payload[5] << 8) + packet->payload[4] && packet->payload[6] == 0x00 && packet->payload[7] == 0x00 && memcmp(&packet->payload[8], "TVANTS", 6) == 0) { NDPI_LOG(NDPI_PROTOCOL_TVANTS, ndpi_struct, NDPI_LOG_DEBUG, "found tvants over tcp. \n"); ndpi_int_tvants_add_connection(ndpi_struct, flow); } NDPI_LOG(NDPI_PROTOCOL_TVANTS, ndpi_struct, NDPI_LOG_DEBUG, "exclude tvants. \n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TVANTS); } void init_tvants_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Tvants", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TVANTS, ndpi_search_tvants_udp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/tvuplayer.c000066400000000000000000000165251321103654100177340ustar00rootroot00000000000000/* * tvuplayer.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_TVUPLAYER static void ndpi_int_tvuplayer_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_TVUPLAYER, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_tvuplayer(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "search tvuplayer. \n"); if (packet->tcp != NULL) { if ((packet->payload_packet_len == 36 || packet->payload_packet_len == 24) && packet->payload[0] == 0x00 && ntohl(get_u_int32_t(packet->payload, 2)) == 0x31323334 && ntohl(get_u_int32_t(packet->payload, 6)) == 0x35363837 && packet->payload[10] == 0x01) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer over tcp. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len >= 50) { if (memcmp(packet->payload, "POST", 4) || memcmp(packet->payload, "GET", 3)) { NDPI_PARSE_PACKET_LINE_INFO(ndpi_struct, flow, packet); if (packet->user_agent_line.ptr != NULL && packet->user_agent_line.len >= 8 && (memcmp(packet->user_agent_line.ptr, "MacTVUP", 7) == 0)) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "Found user agent as MacTVUP.\n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } } } } if (packet->udp != NULL) { if (packet->payload_packet_len == 56 && packet->payload[0] == 0xff && packet->payload[1] == 0xff && packet->payload[2] == 0x00 && packet->payload[3] == 0x01 && packet->payload[12] == 0x02 && packet->payload[13] == 0xff && packet->payload[19] == 0x2c && ((packet->payload[26] == 0x05 && packet->payload[27] == 0x14) || (packet->payload[26] == 0x14 && packet->payload[27] == 0x05))) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer pattern type I. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 82 && packet->payload[0] == 0x00 && packet->payload[2] == 0x00 && packet->payload[10] == 0x00 && packet->payload[11] == 0x00 && packet->payload[12] == 0x01 && packet->payload[13] == 0xff && packet->payload[19] == 0x14 && packet->payload[32] == 0x03 && packet->payload[33] == 0xff && packet->payload[34] == 0x01 && packet->payload[39] == 0x32 && ((packet->payload[46] == 0x05 && packet->payload[47] == 0x14) || (packet->payload[46] == 0x14 && packet->payload[47] == 0x05))) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer pattern type II. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 32 && packet->payload[0] == 0x00 && packet->payload[2] == 0x00 && (packet->payload[10] == 0x00 || packet->payload[10] == 0x65 || packet->payload[10] == 0x7e || packet->payload[10] == 0x49) && (packet->payload[11] == 0x00 || packet->payload[11] == 0x57 || packet->payload[11] == 0x06 || packet->payload[11] == 0x22) && packet->payload[12] == 0x01 && (packet->payload[13] == 0xff || packet->payload[13] == 0x01) && packet->payload[19] == 0x14) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer pattern type III. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 84 && packet->payload[0] == 0x00 && packet->payload[2] == 0x00 && packet->payload[10] == 0x00 && packet->payload[11] == 0x00 && packet->payload[12] == 0x01 && packet->payload[13] == 0xff && packet->payload[19] == 0x14 && packet->payload[32] == 0x03 && packet->payload[33] == 0xff && packet->payload[34] == 0x01 && packet->payload[39] == 0x34) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer pattern type IV. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 102 && packet->payload[0] == 0x00 && packet->payload[2] == 0x00 && packet->payload[10] == 0x00 && packet->payload[11] == 0x00 && packet->payload[12] == 0x01 && packet->payload[13] == 0xff && packet->payload[19] == 0x14 && packet->payload[33] == 0xff && packet->payload[39] == 0x14) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer pattern type V. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } if (packet->payload_packet_len == 62 && packet->payload[0] == 0x00 && packet->payload[2] == 0x00 //&& packet->payload[10] == 0x00 && packet->payload[11] == 0x00 && packet->payload[12] == 0x03 && packet->payload[13] == 0xff && packet->payload[19] == 0x32 && ((packet->payload[26] == 0x05 && packet->payload[27] == 0x14) || (packet->payload[26] == 0x14 && packet->payload[27] == 0x05))) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer pattern type VI. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } // to check, if byte 26, 27, 33,39 match if (packet->payload_packet_len == 60 && packet->payload[0] == 0x00 && packet->payload[2] == 0x00 && packet->payload[10] == 0x00 && packet->payload[11] == 0x00 && packet->payload[12] == 0x06 && packet->payload[13] == 0x00 && packet->payload[19] == 0x30) { NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "found tvuplayer pattern type VII. \n"); ndpi_int_tvuplayer_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_TVUPLAYER, ndpi_struct, NDPI_LOG_DEBUG, "exclude tvuplayer. \n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_TVUPLAYER); } void init_tvuplayer_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("TVUplayer", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_TVUPLAYER, ndpi_search_tvuplayer, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/ubntac2.c000066400000000000000000000056321321103654100172340ustar00rootroot00000000000000/* * ubntac2.c * * Copyright (C) 2015 Thomas Fjellstrom * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_UBNTAC2 static void ndpi_int_ubntac2_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_UBNTAC2, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_ubntac2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_UBNTAC2, ndpi_struct, NDPI_LOG_TRACE, "UBNTAC2 detection... plen:%i %i:%i\n", packet->payload_packet_len, ntohs(packet->udp->source), ntohs(packet->udp->dest)); if(packet->udp) { if(packet->payload_packet_len >= 135 && (packet->udp->source == htons(10001) || packet->udp->dest == htons(10001))) { int found = 0; if(memcmp(&(packet->payload[36]), "UBNT", 4) == 0) { found = 36+5; } else if(memcmp(&(packet->payload[49]), "ubnt", 4) == 0) { found = 49+5; } if(found) { char version[256]; int i, j, len; found += packet->payload[found+1] + 4; /* Skip model name */ found++; /* Skip len*/ if(found < packet->payload_packet_len) { for(i=found, j=0; (packet->payload[i] != 0) && (i < packet->payload_packet_len) && (i < (sizeof(version)-1)); i++) version[j++] = packet->payload[i]; version[j] = '\0'; len = ndpi_min(sizeof(flow->protos.ubntac2.version)-1, j); strncpy(flow->protos.ubntac2.version, (const char *)version, len); flow->protos.ubntac2.version[len] = '\0'; } NDPI_LOG(NDPI_PROTOCOL_UBNTAC2, ndpi_struct, NDPI_LOG_DEBUG, "UBNT AirControl 2 request\n"); ndpi_int_ubntac2_add_connection(ndpi_struct, flow); } return; } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_UBNTAC2); } void init_ubntac2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("UBNTAC2", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_UBNTAC2, ndpi_search_ubntac2, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/usenet.c000066400000000000000000000075651321103654100172100ustar00rootroot00000000000000/* * usenet.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_USENET static void ndpi_int_usenet_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_USENET, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_usenet_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: search usenet.\n"); NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: STAGE IS %u.\n", flow->l4.tcp.usenet_stage); // check for the first server replay /* 200 Service available, posting allowed 201 Service available, posting prohibited */ if (flow->l4.tcp.usenet_stage == 0 && packet->payload_packet_len > 10 && ((memcmp(packet->payload, "200 ", 4) == 0) || (memcmp(packet->payload, "201 ", 4) == 0))) { NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: found 200 or 201.\n"); flow->l4.tcp.usenet_stage = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: maybe hit.\n"); return; } /* [C] AUTHINFO USER fred [S] 381 Enter passphrase [C] AUTHINFO PASS flintstone [S] 281 Authentication accepted */ // check for client username if (flow->l4.tcp.usenet_stage == 2 - packet->packet_direction) { if (packet->payload_packet_len > 20 && (memcmp(packet->payload, "AUTHINFO USER ", 14) == 0)) { NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: username found\n"); flow->l4.tcp.usenet_stage = 3 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: found usenet.\n"); ndpi_int_usenet_add_connection(ndpi_struct, flow); return; } else if (packet->payload_packet_len == 13 && (memcmp(packet->payload, "MODE READER\r\n", 13) == 0)) { NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: no login necessary but we are a client.\n"); NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: found usenet.\n"); ndpi_int_usenet_add_connection(ndpi_struct, flow); return; } } NDPI_LOG(NDPI_PROTOCOL_USENET, ndpi_struct, NDPI_LOG_DEBUG, "USENET: exclude usenet.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_USENET); } void init_usenet_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Usenet", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_USENET, ndpi_search_usenet_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/vhua.c000066400000000000000000000052531321103654100166400ustar00rootroot00000000000000/* * vhua.c * * Copyright (C) 2011-15 - ntop.org * * nDPI is free software: you can vhuatribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" /* http://www.vhua.com Skype-like Chinese phone protocol */ #ifdef NDPI_PROTOCOL_VHUA static void ndpi_int_vhua_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VHUA, NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_VHUA, ndpi_struct, NDPI_LOG_TRACE, "VHUA Found.\n"); } static void ndpi_check_vhua(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; u_char p0[] = { 0x05, 0x14, 0x3a, 0x05, 0x08, 0xf8, 0xa1, 0xb1, 0x03 }; if(payload_len == 0) return; /* Shouldn't happen */ /* Break after 3 packets. */ if((flow->packet_counter > 3) || (packet->udp == NULL) || (packet->payload_packet_len < sizeof(p0))) { NDPI_LOG(NDPI_PROTOCOL_VHUA, ndpi_struct, NDPI_LOG_TRACE, "Exclude VHUA.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VHUA); } else if(memcmp(packet->payload, p0, sizeof(p0)) == 0) { ndpi_int_vhua_add_connection(ndpi_struct, flow); } } void ndpi_search_vhua(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_VHUA, ndpi_struct, NDPI_LOG_TRACE, "VHUA detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_VHUA) { ndpi_check_vhua(ndpi_struct, flow); } } void init_vhua_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("VHUA", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_VHUA, ndpi_search_vhua, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/viber.c000066400000000000000000000043761321103654100170110ustar00rootroot00000000000000/* * viber.c * * Copyright (C) 2013 Remy Mudingay * Copyright (C) 2013 - 2014 ntop.org * * This module is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * This module is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License. * If not, see . */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_VIBER void ndpi_search_viber(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_VIBER, ndpi_struct, NDPI_LOG_DEBUG, "search for VIBER.\n"); if(packet->udp != NULL) { NDPI_LOG(NDPI_PROTOCOL_VIBER, ndpi_struct, NDPI_LOG_DEBUG, "calculating dport over udp.\n"); if((packet->payload_packet_len == 12 && packet->payload[2] == 0x03 && packet->payload[3] == 0x00) || (packet->payload_packet_len == 20 && packet->payload[2] == 0x09 && packet->payload[3] == 0x00) || ((packet->payload_packet_len < 135) && (packet->payload[0] == 0x11))) { NDPI_LOG(NDPI_PROTOCOL_VIBER, ndpi_struct, NDPI_LOG_DEBUG, "found VIBER.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VIBER, NDPI_PROTOCOL_UNKNOWN); return; } } NDPI_LOG(NDPI_PROTOCOL_VIBER, ndpi_struct, NDPI_LOG_DEBUG, "exclude VIBER.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VIBER); } void init_viber_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("VIBER", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_VIBER, ndpi_search_viber, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/vmware.c000066400000000000000000000036551321103654100172020ustar00rootroot00000000000000/* * vmware.c * * Copyright (C) 2016 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_VMWARE void ndpi_search_vmware(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* Check whether this is an VMWARE flow */ if(packet->udp != NULL){ if((packet->payload_packet_len == 66) && (ntohs(packet->udp->dest) == 902) && ((packet->payload[0] & 0xFF) == 0xA4)){ NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "Found vmware.\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VMWARE, NDPI_PROTOCOL_UNKNOWN); return; } } NDPI_LOG(NDPI_PROTOCOL_VMWARE, ndpi_struct, NDPI_LOG_DEBUG, "exclude vmware.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VMWARE); } void init_vmware_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("VMWARE", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_VMWARE, ndpi_search_vmware, NDPI_SELECTION_BITMASK_PROTOCOL_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/vnc.c000066400000000000000000000056151321103654100164650ustar00rootroot00000000000000/* * vnc.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_VNC void ndpi_search_vnc_tcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; /* search over TCP */ if(packet->tcp) { if(flow->l4.tcp.vnc_stage == 0) { if((packet->payload_packet_len == 12) && ((memcmp(packet->payload, "RFB 003.003", 11) == 0 && packet->payload[11] == 0x0a) || (memcmp(packet->payload, "RFB 003.007", 11) == 0 && packet->payload[11] == 0x0a) || (memcmp(packet->payload, "RFB 003.008", 11) == 0 && packet->payload[11] == 0x0a) || (memcmp(packet->payload, "RFB 004.001", 11) == 0 && packet->payload[11] == 0x0a))) { NDPI_LOG(NDPI_PROTOCOL_VNC, ndpi_struct, NDPI_LOG_DEBUG, "reached vnc stage one\n"); flow->l4.tcp.vnc_stage = 1 + packet->packet_direction; return; } } else if(flow->l4.tcp.vnc_stage == 2 - packet->packet_direction) { if((packet->payload_packet_len == 12) && ((memcmp(packet->payload, "RFB 003.003", 11) == 0 && packet->payload[11] == 0x0a) || (memcmp(packet->payload, "RFB 003.007", 11) == 0 && packet->payload[11] == 0x0a) || (memcmp(packet->payload, "RFB 003.008", 11) == 0 && packet->payload[11] == 0x0a) || (memcmp(packet->payload, "RFB 004.001", 11) == 0 && packet->payload[11] == 0x0a))) { NDPI_LOG(NDPI_PROTOCOL_VNC, ndpi_struct, NDPI_LOG_DEBUG, "found vnc\n"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_VNC, NDPI_PROTOCOL_UNKNOWN); return; } } } /* exclude VNC */ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_VNC); } void init_vnc_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("VNC", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_VNC, ndpi_search_vnc_tcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/warcraft3.c000066400000000000000000000100271321103654100175640ustar00rootroot00000000000000/* * warcraft3.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* include files */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_WARCRAFT3 static void ndpi_int_warcraft3_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WARCRAFT3, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_warcraft3(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; u_int16_t l; /* Leave it as u_int32_t because otherwise 'u_int16_t temp' might overflood it and thus generate an infinite loop */ NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "search WARCRAFT3\n"); if (flow->packet_counter == 1 && packet->payload_packet_len == 1 && packet->payload[0] == 0x01) { NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "maybe warcraft3: packet_len == 1\n"); return; } else if (packet->payload_packet_len >= 4 && (packet->payload[0] == 0xf7 || packet->payload[0] == 0xff)) { NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "packet_payload begins with 0xf7 or 0xff\n"); l = packet->payload[2] + (packet->payload[3] << 8); // similar to ntohs NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "l = %u \n", l); while (l <= (packet->payload_packet_len - 4)) { if (packet->payload[l] == 0xf7) { u_int16_t temp = (packet->payload[l + 2 + 1] << 8) + packet->payload[l + 2]; NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "another f7 visited.\n"); if((temp <= 2) || (temp > 1500)) { NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "break\n"); break; } else { l += temp; NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "l = %u \n", l); } } else { NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "break\n"); break; } } if (l == packet->payload_packet_len) { NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "maybe WARCRAFT3\n"); NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "flow->packet_counter = %u \n", flow->packet_counter); if (flow->packet_counter > 2) { NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "detected WARCRAFT3\n"); ndpi_int_warcraft3_add_connection(ndpi_struct, flow); return; } return; } } NDPI_LOG(NDPI_PROTOCOL_WARCRAFT3, ndpi_struct, NDPI_LOG_DEBUG, "no warcraft3 detected.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_WARCRAFT3); } void init_warcraft3_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Warcraft3", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_WARCRAFT3, ndpi_search_warcraft3, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/whoisdas.c000066400000000000000000000047531321103654100175220ustar00rootroot00000000000000/* * whoisdas.c * * Copyright (C) 2016 - ntop.org * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_WHOIS_DAS void ndpi_search_whois_das(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; if(packet->tcp != NULL) { u_int16_t sport = ntohs(packet->tcp->source), dport = ntohs(packet->tcp->dest); if(((sport == 43) || (dport == 43)) || ((sport == 4343) || (dport == 4343))) { if(packet->payload_packet_len > 0) { u_int max_len = sizeof(flow->host_server_name) - 1; u_int i, j; for(i=strlen((const char *)flow->host_server_name), j=0; (ipayload_packet_len); i++, j++) { if((packet->payload[j] == '\n') || (packet->payload[j] == '\r')) break; flow->host_server_name[i] = packet->payload[j]; } flow->host_server_name[i] = '\0'; flow->server_id = ((sport == 43) || (sport == 4343)) ? flow->src : flow->dst; NDPI_LOG(NDPI_PROTOCOL_WHOIS_DAS, ndpi_struct, NDPI_LOG_DEBUG, "[WHOIS/DAS] %s\n", flow->host_server_name); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WHOIS_DAS, NDPI_PROTOCOL_UNKNOWN); return; } } } /* exclude WHOIS */ NDPI_LOG(NDPI_PROTOCOL_WHOIS_DAS, ndpi_struct, NDPI_LOG_TRACE, "WHOIS Excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_WHOIS_DAS); } void init_whois_das_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Whois-DAS", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_WHOIS_DAS, ndpi_search_whois_das, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/world_of_kung_fu.c000066400000000000000000000054531321103654100212300ustar00rootroot00000000000000/* * world_of_kung_fu.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ /* include files */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_WORLD_OF_KUNG_FU static void ndpi_int_world_of_kung_fu_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WORLD_OF_KUNG_FU, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_world_of_kung_fu(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_WORLD_OF_KUNG_FU, ndpi_struct, NDPI_LOG_DEBUG, "search world_of_kung_fu.\n"); if ((packet->payload_packet_len == 16) && ntohl(get_u_int32_t(packet->payload, 0)) == 0x0c000000 && ntohl(get_u_int32_t(packet->payload, 4)) == 0xd2000c00 && (packet->payload[9] == 0x16) && ntohs(get_u_int16_t(packet->payload, 10)) == 0x0000 && ntohs(get_u_int16_t(packet->payload, 14)) == 0x0000) { NDPI_LOG(NDPI_PROTOCOL_WORLD_OF_KUNG_FU, ndpi_struct, NDPI_LOG_DEBUG, "detected world_of_kung_fu.\n"); ndpi_int_world_of_kung_fu_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_WORLD_OF_KUNG_FU, ndpi_struct, NDPI_LOG_DEBUG, "exclude world_of_kung_fu.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_WORLD_OF_KUNG_FU); } void init_world_of_kung_fu_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("WorldOfKungFu", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_WORLD_OF_KUNG_FU, ndpi_search_world_of_kung_fu, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/world_of_warcraft.c000066400000000000000000000222101321103654100213710ustar00rootroot00000000000000/* * world_of_warcraft.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_WORLDOFWARCRAFT static void ndpi_int_worldofwarcraft_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow/* , */ /* ndpi_protocol_type_t protocol_type */) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_WORLDOFWARCRAFT, NDPI_PROTOCOL_UNKNOWN); } #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_int_is_wow_port(const u_int16_t port) { if (port == htons(3724) || port == htons(6112) || port == htons(6113) || port == htons(6114) || port == htons(4000) || port == htons(1119)) { return 1; } return 0; } void ndpi_search_worldofwarcraft(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "Search World of Warcraft.\n"); if (packet->tcp != NULL) { /* if ((packet->payload_packet_len > NDPI_STATICSTRING_LEN("POST /") && memcmp(packet->payload, "POST /", NDPI_STATICSTRING_LEN("POST /")) == 0) || (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /") && memcmp(packet->payload, "GET /", NDPI_STATICSTRING_LEN("GET /")) == 0)) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->user_agent_line.ptr != NULL && packet->user_agent_line.len == NDPI_STATICSTRING_LEN("Blizzard Web Client") && memcmp(packet->user_agent_line.ptr, "Blizzard Web Client", NDPI_STATICSTRING_LEN("Blizzard Web Client")) == 0) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: Web Client found\n"); return; } } */ if (packet->payload_packet_len > NDPI_STATICSTRING_LEN("GET /") && memcmp(packet->payload, "GET /", NDPI_STATICSTRING_LEN("GET /")) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->user_agent_line.ptr != NULL && packet->host_line.ptr != NULL && packet->user_agent_line.len > NDPI_STATICSTRING_LEN("Blizzard Downloader") && packet->host_line.len > NDPI_STATICSTRING_LEN("worldofwarcraft.com") && memcmp(packet->user_agent_line.ptr, "Blizzard Downloader", NDPI_STATICSTRING_LEN("Blizzard Downloader")) == 0 && memcmp(&packet->host_line.ptr[packet->host_line.len - NDPI_STATICSTRING_LEN("worldofwarcraft.com")], "worldofwarcraft.com", NDPI_STATICSTRING_LEN("worldofwarcraft.com")) == 0) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: Web Client found\n"); return; } } if (packet->payload_packet_len == 50 && memcmp(&packet->payload[2], "WORLD OF WARCRAFT CONNECTION", NDPI_STATICSTRING_LEN("WORLD OF WARCRAFT CONNECTION")) == 0) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: Login found\n"); return; } if (packet->tcp->dest == htons(3724) && packet->payload_packet_len < 70 && packet->payload_packet_len > 40 && (memcmp(&packet->payload[4], "WoW", 3) == 0 || memcmp(&packet->payload[5], "WoW", 3) == 0)) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: Login found\n"); return; } if (NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_WORLDOFWARCRAFT) != 0) { if (packet->tcp->source == htons(3724) && packet->payload_packet_len == 8 && get_u_int32_t(packet->payload, 0) == htonl(0x0006ec01)) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: connection detected\n"); return; } } /* for some well known WoW ports check another pattern */ if (flow->l4.tcp.wow_stage == 0) { if (ndpi_int_is_wow_port(packet->tcp->source) && packet->payload_packet_len >= 14 && ntohs(get_u_int16_t(packet->payload, 0)) == (packet->payload_packet_len - 2)) { if (get_u_int32_t(packet->payload, 2) == htonl(0xec010100)) { NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "probably World of Warcraft, waiting for final packet\n"); flow->l4.tcp.wow_stage = 2; return; } else if (packet->payload_packet_len == 41 && (get_u_int16_t(packet->payload, 2) == htons(0x0085) || get_u_int16_t(packet->payload, 2) == htons(0x0034) || get_u_int16_t(packet->payload, 2) == htons(0x1960))) { NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "maybe World of Warcraft, need next\n"); flow->l4.tcp.wow_stage = 1; return; } } } if (flow->l4.tcp.wow_stage == 1) { if (packet->payload_packet_len == 325 && ntohs(get_u_int16_t(packet->payload, 0)) == (packet->payload_packet_len - 2) && get_u_int16_t(packet->payload, 4) == 0 && (get_u_int16_t(packet->payload, packet->payload_packet_len - 3) == htons(0x2331) || get_u_int16_t(packet->payload, 67) == htons(0x2331)) && (memcmp (&packet->payload[packet->payload_packet_len - 18], "\x94\xec\xff\xfd\x67\x62\xd4\x67\xfb\xf9\xdd\xbd\xfd\x01\xc0\x8f\xf9\x81", 18) == 0 || memcmp(&packet->payload[packet->payload_packet_len - 30], "\x94\xec\xff\xfd\x67\x62\xd4\x67\xfb\xf9\xdd\xbd\xfd\x01\xc0\x8f\xf9\x81", 18) == 0)) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: connection detected\n"); return; } if (packet->payload_packet_len > 32 && ntohs(get_u_int16_t(packet->payload, 0)) == (packet->payload_packet_len - 2)) { if (get_u_int16_t(packet->payload, 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "probably World of Warcraft, waiting for final packet\n"); flow->l4.tcp.wow_stage = 2; return; } else if (get_u_int32_t(packet->payload, 2) == htonl(0x12050000)) { NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "probably World of Warcraft, waiting for final packet\n"); flow->l4.tcp.wow_stage = 2; return; } } } if (flow->l4.tcp.wow_stage == 2) { if (packet->payload_packet_len == 4) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: connection detected\n"); return; } else if (packet->payload_packet_len > 4 && packet->payload_packet_len <= 16 && packet->payload[4] == 0x0c) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: connection detected\n"); return; } else if (flow->packet_counter < 3) { NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "waiting for final packet\n"); return; } } if (flow->l4.tcp.wow_stage == 0 && packet->tcp->dest == htons(1119)) { /* special log in port for battle.net/world of warcraft */ if (packet->payload_packet_len >= 77 && get_u_int32_t(packet->payload, 0) == htonl(0x40000aed) && get_u_int32_t(packet->payload, 4) == htonl(0xea070aed)) { ndpi_int_worldofwarcraft_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_struct, NDPI_LOG_DEBUG, "World of Warcraft: connection detected\n"); return; } } } NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_WORLDOFWARCRAFT); } void init_world_of_warcraft_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("WorldOfWarcraft", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_WORLDOFWARCRAFT, ndpi_search_worldofwarcraft, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/xbox.c000066400000000000000000000104151321103654100166510ustar00rootroot00000000000000/* * xbox.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_XBOX static void ndpi_int_xbox_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_XBOX, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_xbox(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src = flow->src; // struct ndpi_id_struct *dst = flow->dst; /* * XBOX UDP DETCTION ONLY * the xbox TCP detection is done by http code * this detection also works for asymmetric xbox udp traffic */ if(packet->udp != NULL) { u_int16_t dport = ntohs(packet->udp->dest); u_int16_t sport = ntohs(packet->udp->source); NDPI_LOG(NDPI_PROTOCOL_XBOX, ndpi_struct, NDPI_LOG_DEBUG, "search xbox\n"); if (packet->payload_packet_len > 12 && get_u_int32_t(packet->payload, 0) == 0 && packet->payload[5] == 0x58 && memcmp(&packet->payload[7], "\x00\x00\x00", 3) == 0) { if ((packet->payload[4] == 0x0c && packet->payload[6] == 0x76) || (packet->payload[4] == 0x02 && packet->payload[6] == 0x18) || (packet->payload[4] == 0x0b && packet->payload[6] == 0x80) || (packet->payload[4] == 0x03 && packet->payload[6] == 0x40) || (packet->payload[4] == 0x06 && packet->payload[6] == 0x4e)) { ndpi_int_xbox_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_XBOX, ndpi_struct, NDPI_LOG_DEBUG, "xbox udp connection detected\n"); return; } } if ((dport == 3074 || sport == 3074) && ((packet->payload_packet_len == 24 && packet->payload[0] == 0x00) || (packet->payload_packet_len == 42 && packet->payload[0] == 0x4f && packet->payload[2] == 0x0a) || (packet->payload_packet_len == 80 && ntohs(get_u_int16_t(packet->payload, 0)) == 0x50bc && packet->payload[2] == 0x45) || (packet->payload_packet_len == 40 && ntohl(get_u_int32_t(packet->payload, 0)) == 0xcf5f3202) || (packet->payload_packet_len == 38 && ntohl(get_u_int32_t(packet->payload, 0)) == 0xc1457f03) || (packet->payload_packet_len == 28 && ntohl(get_u_int32_t(packet->payload, 0)) == 0x015f2c00))) { if (flow->l4.udp.xbox_stage == 1) { ndpi_int_xbox_add_connection(ndpi_struct, flow); NDPI_LOG(NDPI_PROTOCOL_XBOX, ndpi_struct, NDPI_LOG_DEBUG, "xbox udp connection detected\n"); return; } NDPI_LOG(NDPI_PROTOCOL_XBOX, ndpi_struct, NDPI_LOG_DEBUG, "maybe xbox.\n"); flow->l4.udp.xbox_stage++; return; } /* exclude here all non matched udp traffic, exclude here tcp only if http has been excluded, because xbox could use http */ #ifdef NDPI_PROTOCOL_HTTP if(NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_HTTP) != 0) { #endif NDPI_LOG(NDPI_PROTOCOL_XBOX, ndpi_struct, NDPI_LOG_DEBUG, "xbox udp excluded.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_XBOX); } } /* to not exclude tcp traffic here, done by http code... */ } void init_xbox_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Xbox", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_XBOX, ndpi_search_xbox, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD, NO_SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/xdmcp.c000066400000000000000000000060721321103654100170100ustar00rootroot00000000000000/* * xdmcp.c * * Copyright (C) 2009-2011 by ipoque GmbH * Copyright (C) 2011-15 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_protocols.h" #ifdef NDPI_PROTOCOL_XDMCP static void ndpi_int_xdmcp_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_XDMCP, NDPI_PROTOCOL_UNKNOWN); } void ndpi_search_xdmcp(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; // struct ndpi_id_struct *src=ndpi_struct->src; // struct ndpi_id_struct *dst=ndpi_struct->dst; NDPI_LOG(NDPI_PROTOCOL_XDMCP, ndpi_struct, NDPI_LOG_DEBUG, "search xdmcp.\n"); if (packet->tcp != NULL && (ntohs(packet->tcp->dest) >= 6000 && ntohs(packet->tcp->dest) <= 6005) && packet->payload_packet_len == 48 && packet->payload[0] == 0x6c && packet->payload[1] == 0x00 && ntohs(get_u_int16_t(packet->payload, 6)) == 0x1200 && ntohs(get_u_int16_t(packet->payload, 8)) == 0x1000) { NDPI_LOG(NDPI_PROTOCOL_XDMCP, ndpi_struct, NDPI_LOG_DEBUG, "found xdmcp over tcp.\n"); ndpi_int_xdmcp_add_connection(ndpi_struct, flow); return; } if (packet->udp != NULL && ntohs(packet->udp->dest) == 177 && packet->payload_packet_len >= 6 && packet->payload_packet_len == 6 + ntohs(get_u_int16_t(packet->payload, 4)) && ntohs(get_u_int16_t(packet->payload, 0)) == 0x0001 && ntohs(get_u_int16_t(packet->payload, 2)) == 0x0002) { NDPI_LOG(NDPI_PROTOCOL_XDMCP, ndpi_struct, NDPI_LOG_DEBUG, "found xdmcp over udp.\n"); ndpi_int_xdmcp_add_connection(ndpi_struct, flow); return; } NDPI_LOG(NDPI_PROTOCOL_XDMCP, ndpi_struct, NDPI_LOG_DEBUG, "exclude xdmcp.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_XDMCP); } void init_xdmcp_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("XDMCP", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_XDMCP, ndpi_search_xdmcp, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/yahoo.c000066400000000000000000000413601321103654100170130ustar00rootroot00000000000000/* * yahoo.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_YAHOO struct ndpi_yahoo_header { u_int8_t YMSG_str[4]; u_int16_t version; u_int16_t nothing0; u_int16_t len; u_int16_t service; u_int32_t status; u_int32_t session_id; }; /* This function checks the pattern 'packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; const struct ndpi_yahoo_header *yahoo = (struct ndpi_yahoo_header *) packet->payload; if(packet->tcp) { if(packet->payload_packet_len > 0) { /* packet must be at least 20 bytes long */ if(packet->payload_packet_len >= 20 && memcmp(yahoo->YMSG_str, "YMSG", 4) == 0 && ((packet->payload_packet_len - 20) == ntohs(yahoo->len) || check_ymsg(packet->payload, packet->payload_packet_len))) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO FOUND\n"); flow->yahoo_detection_finished = 2; if(ntohs(yahoo->service) == 24 || ntohs(yahoo->service) == 152 || ntohs(yahoo->service) == 74) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO conference or chat invite found"); if(src != NULL) src->yahoo_conf_logged_in = 1; if(dst != NULL) dst->yahoo_conf_logged_in = 1; } if(ntohs(yahoo->service) == 27 || ntohs(yahoo->service) == 155 || ntohs(yahoo->service) == 160) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO conference or chat logoff found"); if(src != NULL) { src->yahoo_conf_logged_in = 0; src->yahoo_voice_conf_logged_in = 0; } } NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } else if(flow->yahoo_detection_finished == 2 && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_YAHOO) { return; } else if(packet->payload_packet_len == 4 && memcmp(yahoo->YMSG_str, "YMSG", 4) == 0) { flow->l4.tcp.yahoo_sip_comm = 1; return; } else if(flow->l4.tcp.yahoo_sip_comm && packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN && flow->packet_counter < 3) { return; } /* now test for http login, at least 100 a bytes packet */ if(ndpi_struct->yahoo_detect_http_connections != 0 && packet->payload_packet_len > 100) { if(memcmp(packet->payload, "POST /relay?token=", 18) == 0 || memcmp(packet->payload, "GET /relay?token=", 17) == 0 || memcmp(packet->payload, "GET /?token=", 12) == 0 || memcmp(packet->payload, "HEAD /relay?token=", 18) == 0) { if((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0) || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0)) { /* this is mostly a file transfer */ NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } } if(memcmp(packet->payload, "POST ", 5) == 0) { u_int16_t a; ndpi_parse_packet_line_info(ndpi_struct, flow); if ((packet->user_agent_line.len >= 21) && (memcmp(packet->user_agent_line.ptr, "YahooMobileMessenger/", 21) == 0)) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO(Mobile)"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } if (NDPI_SRC_OR_DST_HAS_PROTOCOL(src, dst, NDPI_PROTOCOL_YAHOO) && packet->parsed_lines > 5 && memcmp(&packet->payload[5], "/Messenger.", 11) == 0 && packet->line[1].len >= 17 && memcmp(packet->line[1].ptr, "Connection: Close", 17) == 0 && packet->line[2].len >= 6 && memcmp(packet->line[2].ptr, "Host: ", 6) == 0 && packet->line[3].len >= 16 && memcmp(packet->line[3].ptr, "Content-Length: ", 16) == 0 && packet->line[4].len >= 23 && memcmp(packet->line[4].ptr, "User-Agent: Mozilla/5.0", 23) == 0 && packet->line[5].len >= 23 && memcmp(packet->line[5].ptr, "Cache-Control: no-cache", 23) == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO HTTP POST P2P FILETRANSFER FOUND\n"); NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } if (packet->host_line.ptr != NULL && packet->host_line.len >= 26 && memcmp(packet->host_line.ptr, "filetransfer.msg.yahoo.com", 26) == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO HTTP POST FILETRANSFER FOUND\n"); NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } /* now check every line */ for (a = 0; a < packet->parsed_lines; a++) { if (packet->line[a].len >= 4 && memcmp(packet->line[a].ptr, "YMSG", 4) == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO HTTP POST FOUND, line is: %.*s\n", packet->line[a].len, packet->line[a].ptr); NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } } if (packet->parsed_lines > 8 && packet->line[8].len > 250 && packet->line[8].ptr != NULL) { if (memcmp(packet->line[8].ptr, "line[8].len, packet->line[8].ptr)) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found HTTP Proxy Yahoo Chat payload, "GET /Messenger.", 15) == 0) { if((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0) || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0)) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO HTTP GET /Messenger. match\n"); NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } } if((memcmp(packet->payload, "GET /", 5) == 0)) { ndpi_parse_packet_line_info(ndpi_struct, flow); if((packet->user_agent_line.ptr != NULL && packet->user_agent_line.len >= NDPI_STATICSTRING_LEN("YahooMobileMessenger/") && memcmp(packet->user_agent_line.ptr, "YahooMobileMessenger/", NDPI_STATICSTRING_LEN("YahooMobileMessenger/")) == 0) || (packet->user_agent_line.len >= 15 && (memcmp(packet->user_agent_line.ptr, "Y!%20Messenger/", 15) == 0))) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO(Mobile)"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } if(packet->host_line.ptr != NULL && packet->host_line.len >= NDPI_STATICSTRING_LEN("msg.yahoo.com") && memcmp(&packet->host_line.ptr[packet->host_line.len - NDPI_STATICSTRING_LEN("msg.yahoo.com")], "msg.yahoo.com", NDPI_STATICSTRING_LEN("msg.yahoo.com")) == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } } } /* found another http login command for yahoo, it is like OSCAR */ /* detect http connections */ if (packet->payload_packet_len > 50 && (memcmp(packet->payload, "content-length: ", 16) == 0)) { ndpi_parse_packet_line_info(ndpi_struct, flow); if (packet->parsed_lines > 2 && packet->line[1].len == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "first line is empty.\n"); if (packet->line[2].len > 13 && memcmp(packet->line[2].ptr, "payload_packet_len > 38 && memcmp(packet->payload, "CONNECT scs.msg.yahoo.com:5050 HTTP/1.", 38) == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO-HTTP FOUND\n"); NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } if ((src != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0) || (dst != NULL && NDPI_COMPARE_PROTOCOL_TO_BITMASK(dst->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) != 0)) { if (packet->payload_packet_len == 6 && memcmp(packet->payload, "YAHOO!", 6) == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } /* asymmetric detection for SNDIMG not done yet. * See ./Yahoo8.1-VideoCall-LAN.pcap and ./Yahoo-VideoCall-inPublicIP.pcap */ if (packet->payload_packet_len == 8 && (memcmp(packet->payload, "", 8) == 0 || memcmp(packet->payload, "", 8) == 0 || memcmp(packet->payload, "", 8) == 0 || memcmp(packet->payload, "", 8) == 0)) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_TRACE, "YAHOO SNDIMG or REQIMG or RVWCFG or RUPCFG FOUND\n"); if(src != NULL) { if (memcmp(packet->payload, "", 8) == 0) { src->yahoo_video_lan_dir = 0; } else { src->yahoo_video_lan_dir = 1; } src->yahoo_video_lan_timer = packet->tick_timestamp; } if(dst != NULL) { if (memcmp(packet->payload, "", 8) == 0) { dst->yahoo_video_lan_dir = 0; } else { dst->yahoo_video_lan_dir = 1; } dst->yahoo_video_lan_timer = packet->tick_timestamp; } NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO subtype VIDEO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); return; } if(src != NULL && packet->tcp->dest == htons(5100) && ((u_int32_t) (packet->tick_timestamp - src->yahoo_video_lan_timer) < ndpi_struct->yahoo_lan_video_timeout)) { if (src->yahoo_video_lan_dir == 1) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "IMG MARKED"); return; } } if (dst != NULL && packet->tcp->dest == htons(5100) && ((u_int32_t) (packet->tick_timestamp - dst->yahoo_video_lan_timer) < ndpi_struct->yahoo_lan_video_timeout)) { if (dst->yahoo_video_lan_dir == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found YAHOO"); ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_YAHOO, NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "IMG MARKED"); return; } } } /* detect YAHOO over HTTP proxy */ #ifdef NDPI_PROTOCOL_HTTP if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP) #endif { if (flow->l4.tcp.yahoo_http_proxy_stage == 0) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "YAHOO maybe HTTP proxy packet 1 => need next packet\n"); flow->l4.tcp.yahoo_http_proxy_stage = 1 + packet->packet_direction; return; } if (flow->l4.tcp.yahoo_http_proxy_stage == 1 + packet->packet_direction) { if ((packet->payload_packet_len > 250) && (memcmp(packet->payload, "payload_packet_len, packet->payload)) { NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "found HTTP Proxy Yahoo Chat need next packet\n"); return; } if (flow->l4.tcp.yahoo_http_proxy_stage == 2 - packet->packet_direction) { ndpi_parse_packet_line_info_any(ndpi_struct, flow); if (packet->parsed_lines >= 9) { if (packet->line[4].ptr != NULL && packet->line[4].len >= 9 && packet->line[8].ptr != NULL && packet->line[8].len >= 6 && memcmp(packet->line[4].ptr, "line[8].ptr, "excluded_protocol_bitmask, NDPI_PROTOCOL_YAHOO); } } void ndpi_search_yahoo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_YAHOO, ndpi_struct, NDPI_LOG_DEBUG, "search yahoo\n"); if(packet->payload_packet_len > 0 && flow->yahoo_detection_finished == 0) { /* search over TCP */ if(packet->tcp != NULL && packet->tcp_retransmission == 0) { if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_UNKNOWN #ifdef NDPI_PROTOCOL_HTTP || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_HTTP #endif #ifdef NDPI_PROTOCOL_SSL || packet->detected_protocol_stack[0] == NDPI_PROTOCOL_SSL) { #endif ndpi_search_yahoo_tcp(ndpi_struct, flow); } } /* search over UDP */ else if(packet->udp != NULL) { if(flow->src == NULL || NDPI_COMPARE_PROTOCOL_TO_BITMASK(flow->src->detected_protocol_bitmask, NDPI_PROTOCOL_YAHOO) == 0) NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_YAHOO); return; } } if(packet->payload_packet_len > 0 && flow->yahoo_detection_finished == 2) { if(packet->tcp != NULL && packet->tcp_retransmission == 0) { /* search over TCP */ ndpi_search_yahoo_tcp(ndpi_struct, flow); return; } } } void init_yahoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("YAHOO", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_YAHOO, ndpi_search_yahoo, NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/zattoo.c000066400000000000000000000262351321103654100172200ustar00rootroot00000000000000/* * zattoo.c * * Copyright (C) 2016 - ntop.org * * This file is part of nDPI, an open source deep packet inspection * library based on the OpenDPI and PACE technology by ipoque GmbH * * nDPI is free software: you can redistribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_ZATTOO #if !defined(WIN32) static inline #elif defined(MINGW_GCC) __mingw_forceinline static #else __forceinline static #endif u_int8_t ndpi_int_zattoo_user_agent_set(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { if(flow->packet.user_agent_line.ptr != NULL && flow->packet.user_agent_line.len == 111) { if(memcmp(flow->packet.user_agent_line.ptr + flow->packet.user_agent_line.len - 25, "Zattoo/4", sizeof("Zattoo/4") - 1) == 0) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "found zattoo useragent\n"); return 1; } } return 0; } void ndpi_search_zattoo(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; struct ndpi_id_struct *src = flow->src; struct ndpi_id_struct *dst = flow->dst; u_int16_t i; if(packet->detected_protocol_stack[0] == NDPI_PROTOCOL_ZATTOO) { if(src != NULL && ((u_int32_t) (packet->tick_timestamp - src->zattoo_ts) < ndpi_struct->zattoo_connection_timeout)) src->zattoo_ts = packet->tick_timestamp; if (dst != NULL && ((u_int32_t) (packet->tick_timestamp - dst->zattoo_ts) < ndpi_struct->zattoo_connection_timeout)) dst->zattoo_ts = packet->tick_timestamp; return; } /* search over TCP */ if(packet->tcp != NULL) { if(packet->payload_packet_len > 50 && memcmp(packet->payload, "GET /frontdoor/fd?brand=Zattoo&v=", 33) == 0) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "add connection over tcp with pattern GET /frontdoor/fd?brand=Zattoo&v=\n"); if (src != NULL) src->zattoo_ts = packet->tick_timestamp; if (dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } if(packet->payload_packet_len > 50 && memcmp(packet->payload, "GET /ZattooAdRedirect/redirect.jsp?user=", 40) == 0) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "add connection over tcp with pattern GET /ZattooAdRedirect/redirect.jsp?user=\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } if(packet->payload_packet_len > 50 && (memcmp(packet->payload, "POST /channelserver/player/channel/update HTTP/1.1", 50) == 0 || memcmp(packet->payload, "GET /epg/query", 14) == 0)) { ndpi_parse_packet_line_info(ndpi_struct, flow); for(i = 0; i < packet->parsed_lines; i++) { if(packet->line[i].len >= 18 && (memcmp(packet->line[i].ptr, "User-Agent: Zattoo", 18) == 0)) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "add connection over tcp with pattern POST /channelserver/player/channel/update HTTP/1.1\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } } } else if(packet->payload_packet_len > 50 && (memcmp(packet->payload, "GET /", 5) == 0 || memcmp(packet->payload, "POST /", NDPI_STATICSTRING_LEN("POST /")) == 0)) { /* TODO to avoid searching currently only a specific length and offset is used * that might be changed later */ ndpi_parse_packet_line_info(ndpi_struct, flow); if(ndpi_int_zattoo_user_agent_set(ndpi_struct, flow)) { if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } } else if(packet->payload_packet_len > 50 && memcmp(packet->payload, "POST http://", 12) == 0) { ndpi_parse_packet_line_info(ndpi_struct, flow); // test for unique character of the zattoo header if(packet->parsed_lines == 4 && packet->host_line.ptr != NULL) { u_int32_t ip; u_int16_t bytes_read = 0; ip = ndpi_bytestream_to_ipv4(&packet->payload[12], packet->payload_packet_len, &bytes_read); // and now test the firt 5 bytes of the payload for zattoo pattern if(ip == packet->iph->daddr && packet->empty_line_position_set != 0 && ((packet->payload_packet_len - packet->empty_line_position) > 10) && packet->payload[packet->empty_line_position + 2] == 0x03 && packet->payload[packet->empty_line_position + 3] == 0x04 && packet->payload[packet->empty_line_position + 4] == 0x00 && packet->payload[packet->empty_line_position + 5] == 0x04 && packet->payload[packet->empty_line_position + 6] == 0x0a && packet->payload[packet->empty_line_position + 7] == 0x00) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "add connection over tcp with pattern POST http://\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } } } else if(flow->zattoo_stage == 0) { if(packet->payload_packet_len > 50 && packet->payload[0] == 0x03 && packet->payload[1] == 0x04 && packet->payload[2] == 0x00 && packet->payload[3] == 0x04 && packet->payload[4] == 0x0a && packet->payload[5] == 0x00) { flow->zattoo_stage = 1 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "need next packet, seen pattern 0x030400040a00\n"); return; } /* the following is searching for flash, not for zattoo. */ } else if(flow->zattoo_stage == 2 - packet->packet_direction && packet->payload_packet_len > 50 && packet->payload[0] == 0x03 && packet->payload[1] == 0x04) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "add connection over tcp with 0x0304.\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } else if(flow->zattoo_stage == 1 + packet->packet_direction) { if(packet->payload_packet_len > 500 && packet->payload[0] == 0x00 && packet->payload[1] == 0x00) { flow->zattoo_stage = 3 + packet->packet_direction; NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "need next packet, seen pattern 0x0000\n"); return; } if(packet->payload_packet_len > 50 && packet->payload[0] == 0x03 && packet->payload[1] == 0x04 && packet->payload[2] == 0x00 && packet->payload[3] == 0x04 && packet->payload[4] == 0x0a && packet->payload[5] == 0x00) { } NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "need next packet, seen pattern 0x030400040a00\n"); return; } else if(flow->zattoo_stage == 4 - packet->packet_direction && packet->payload_packet_len > 50 && packet->payload[0] == 0x03 && packet->payload[1] == 0x04) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "add connection over tcp with 0x0304.\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } else if(flow->zattoo_stage == 5 + packet->packet_direction && (packet->payload_packet_len == 125)) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "detected zattoo.\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } else if(flow->zattoo_stage == 6 - packet->packet_direction && packet->payload_packet_len == 1412) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "found zattoo.\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "ZATTOO: discarded the flow (TCP): packet_size: %u; Flowstage: %u\n", packet->payload_packet_len, flow->zattoo_stage); } /* search over UDP */ else if(packet->udp != NULL) { if(packet->payload_packet_len > 20 && (packet->udp->dest == htons(5003) || packet->udp->source == htons(5003)) && (get_u_int16_t(packet->payload, 0) == htons(0x037a) || get_u_int16_t(packet->payload, 0) == htons(0x0378) || get_u_int16_t(packet->payload, 0) == htons(0x0305) || get_u_int32_t(packet->payload, 0) == htonl(0x03040004) || get_u_int32_t(packet->payload, 0) == htonl(0x03010005))) { if(++flow->zattoo_stage == 2) { NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "add connection over udp.\n"); if(src != NULL) src->zattoo_ts = packet->tick_timestamp; if(dst != NULL) dst->zattoo_ts = packet->tick_timestamp; ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZATTOO, NDPI_PROTOCOL_UNKNOWN); return; } NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "need next packet udp.\n"); return; } NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "ZATTOO: discarded the flow (UDP): packet_size: %u; Flowstage: %u\n", packet->payload_packet_len, flow->zattoo_stage); } /* exclude ZATTOO */ NDPI_LOG(NDPI_PROTOCOL_ZATTOO, ndpi_struct, NDPI_LOG_DEBUG, "exclude zattoo.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_ZATTOO); } void init_zattoo_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("Zattoo", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_ZATTOO, ndpi_search_zattoo, NDPI_SELECTION_BITMASK_PROTOCOL_TCP_OR_UDP_WITH_PAYLOAD, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/protocols/zeromq.c000066400000000000000000000077421321103654100172170ustar00rootroot00000000000000/* * zmq.c * * Copyright (C) 2016 - ntop.org * * nDPI is free software: you can zmqtribute it and/or modify * it under the terms of the GNU Lesser General Public License as published by * the Free Software Foundation, either version 3 of the License, or * (at your option) any later version. * * nDPI is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU Lesser General Public License for more details. * * You should have received a copy of the GNU Lesser General Public License * along with nDPI. If not, see . * */ #include "ndpi_api.h" #ifdef NDPI_PROTOCOL_ZMQ static void ndpi_int_zmq_add_connection(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_ZMQ, NDPI_PROTOCOL_UNKNOWN); NDPI_LOG(NDPI_PROTOCOL_ZMQ, ndpi_struct, NDPI_LOG_TRACE, "ZMQ Found.\n"); } static void ndpi_check_zmq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; u_int32_t payload_len = packet->payload_packet_len; u_char p0[] = { 0x00, 0x00, 0x00, 0x05, 0x01, 0x66, 0x6c, 0x6f, 0x77 }; u_char p1[] = { 0xff, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x7f }; u_char p2[] = { 0x28, 0x66, 0x6c, 0x6f, 0x77, 0x00 }; if(payload_len == 0) return; /* Shouldn't happen */ /* Break after 17 packets. */ if(flow->packet_counter > 17) { NDPI_LOG(NDPI_PROTOCOL_ZMQ, ndpi_struct, NDPI_LOG_TRACE, "Exclude ZMQ.\n"); NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_ZMQ); return; } if(flow->l4.tcp.prev_zmq_pkt_len == 0) { flow->l4.tcp.prev_zmq_pkt_len = ndpi_min(packet->payload_packet_len, 10); memcpy(flow->l4.tcp.prev_zmq_pkt, packet->payload, flow->l4.tcp.prev_zmq_pkt_len); return; /* Too early */ } if(payload_len == 2) { if(flow->l4.tcp.prev_zmq_pkt_len == 2) { if((memcmp(packet->payload, "\01\01", 2) == 0) && (memcmp(flow->l4.tcp.prev_zmq_pkt, "\01\02", 2) == 0)) { ndpi_int_zmq_add_connection(ndpi_struct, flow); return; } } else if(flow->l4.tcp.prev_zmq_pkt_len == 9) { if((memcmp(packet->payload, "\00\00", 2) == 0) && (memcmp(flow->l4.tcp.prev_zmq_pkt, p0, 9) == 0)) { ndpi_int_zmq_add_connection(ndpi_struct, flow); return; } } else if(flow->l4.tcp.prev_zmq_pkt_len == 10) { if((memcmp(packet->payload, "\01\02", 2) == 0) && (memcmp(flow->l4.tcp.prev_zmq_pkt, p1, 10) == 0)) { ndpi_int_zmq_add_connection(ndpi_struct, flow); return; } } } else if(payload_len >= 10) { if(flow->l4.tcp.prev_zmq_pkt_len == 10) { if(((memcmp(packet->payload, p1, 10) == 0) && (memcmp(flow->l4.tcp.prev_zmq_pkt, p1, 10) == 0)) || ((memcmp(&packet->payload[1], p2, sizeof(p2)) == 0) && (memcmp(&flow->l4.tcp.prev_zmq_pkt[1], p2, sizeof(p2)) == 0))) { ndpi_int_zmq_add_connection(ndpi_struct, flow); return; } } } } void ndpi_search_zmq(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow) { struct ndpi_packet_struct *packet = &flow->packet; NDPI_LOG(NDPI_PROTOCOL_ZMQ, ndpi_struct, NDPI_LOG_TRACE, "ZMQ detection...\n"); /* skip marked packets */ if(packet->detected_protocol_stack[0] != NDPI_PROTOCOL_ZMQ) { if(packet->tcp && packet->tcp_retransmission == 0) { ndpi_check_zmq(ndpi_struct, flow); } } } void init_zmq_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask) { ndpi_set_bitmask_protocol_detection("ZeroMQ", ndpi_struct, detection_bitmask, *id, NDPI_PROTOCOL_ZMQ, ndpi_search_zmq, /* TODO: add UDP support */ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_WITH_PAYLOAD_WITHOUT_RETRANSMISSION, SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK); *id += 1; } #endif nDPI-2.2/src/lib/third_party/000077500000000000000000000000001321103654100160315ustar00rootroot00000000000000nDPI-2.2/src/lib/third_party/include/000077500000000000000000000000001321103654100174545ustar00rootroot00000000000000nDPI-2.2/src/lib/third_party/include/actypes.h000066400000000000000000000132411321103654100212760ustar00rootroot00000000000000/* * actypes.h: Includes basic data types of ahocorasick library * This file is part of multifast. * Copyright 2010-2012 Kamiar Kanani multifast is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. multifast is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with multifast. If not, see . */ #ifndef _AC_TYPES_H_ #define _AC_TYPES_H_ /* AC_ALPHABET_t: * defines the alphabet type. * Actually defining AC_ALPHABET_t as a char will work, but sometimes we deal * with streams of other (bigger) types e.g. integers, specific enum, objects. * Although they consists of string of bytes (chars), but using their specific * types for AC_ALPHABET_t will lead to a better performance. so instead of * dealing with strings of chars, we assume dealing with strings of * AC_ALPHABET_t and leave it optional for other developers to define their * own alphabets. **/ typedef char AC_ALPHABET_t; /* AC_REP_t: * Provides a more readable representative for a pattern. * because patterns themselves are not always suitable for displaying * (e.g. for hex patterns), we offer this type to improve intelligibility * of output. furthermore, sometimes it is useful, for example while * retrieving patterns from a database, to maintain their identifiers in the * automata for further reference. we provisioned two possible types as a * union for this purpose. you can add your desired type in it. **/ typedef union { char * stringy; /* null-terminated string */ unsigned long number; } AC_REP_t; /* AC_PATTERN_t: * This is the pattern type that must be fed into AC automata. * the 'astring' field is not null-terminated, due to it can contain zero * value bytes. the 'length' field determines the number of AC_ALPHABET_t it * carries. the 'representative' field is described in AC_REP_t. despite * 'astring', 'representative' can have duplicate values for different given * AC_PATTERN_t. it is an optional field and you can just fill it with 0. * CAUTION: * Not always the 'astring' points to the correct position in memory. * it is the responsibility of your program to maintain a permanent allocation * for astring field of the added pattern to automata. **/ typedef struct { AC_ALPHABET_t * astring; /* String of alphabets */ unsigned int length; /* Length of pattern */ AC_REP_t rep; /* Representative string (optional) */ } AC_PATTERN_t; /* AC_TEXT_t: * The input text type that is fed to ac_automata_search() to be searched. * it is similar to AC_PATTERN_t. actually we could use AC_PATTERN_t as input * text, but for the purpose of being more readable, we defined this new type. **/ typedef struct { AC_ALPHABET_t * astring; /* String of alphabets */ unsigned int length; /* Length of string */ } AC_TEXT_t; /* AC_MATCH_t: * Provides the structure for reporting a match event. * a match event occurs when the automata reaches a final node. any final * node can match one or more pattern at a position in a text. the * 'patterns' field holds these matched patterns. obviously these * matched patterns have same end-position in the text. there is a relationship * between matched patterns: the shorter one is a factor (tail) of the longer * one. the 'position' maintains the end position of matched patterns. the * start position of patterns could be found by knowing their 'length' in * AC_PATTERN_t. e.g. suppose "recent" and "cent" are matched at * position 40 in the text, then the start position of them are 34 and 36 * respectively. finally the field 'match_num' maintains the number of * matched patterns. **/ typedef struct { AC_PATTERN_t * patterns; /* Array of matched pattern */ long position; /* The end position of matching pattern(s) in the text */ unsigned int match_num; /* Number of matched patterns */ } AC_MATCH_t; /* AC_ERROR_t: * Error that may occur while adding a pattern to the automata. * it is returned by ac_automata_add(). **/ typedef enum { ACERR_SUCCESS = 0, /* No error occurred */ ACERR_DUPLICATE_PATTERN, /* Duplicate patterns */ ACERR_LONG_PATTERN, /* Pattern length is longer than AC_PATTRN_MAX_LENGTH */ ACERR_ZERO_PATTERN, /* Empty pattern (zero length) */ ACERR_AUTOMATA_CLOSED, /* Automata is closed. after calling ac_automata_finalize() you can not add new patterns to the automata. */ } AC_ERROR_t; /* MATCH_CALBACK_t: * This is the call-back function type that must be given to automata at * initialization to report match occurrence to the caller. * at a match event, the automata will reach you using this function and sends * you a pointer to AC_MATCH_t. using that pointer you can handle * matches. you can send parameters to the call-back function when you call * ac_automata_search(). at call-back, the automata will sent you those * parameters as the second parameter (void *) of MATCH_CALBACK_t. inside * the call-back function you can cast it to whatever you want. * If you return 0 from MATCH_CALBACK_t function to the automata, it will * continue searching, otherwise it will return from ac_automata_search() * to your calling function. **/ typedef int (*MATCH_CALBACK_f)(AC_MATCH_t *, void *); /* AC_PATTRN_MAX_LENGTH: * Maximum acceptable pattern length in AC_PATTERN_t.length **/ #define AC_PATTRN_MAX_LENGTH 1024 #endif nDPI-2.2/src/lib/third_party/include/ahocorasick.h000066400000000000000000000052021321103654100221120ustar00rootroot00000000000000/* * ahocorasick.h: the main ahocorasick header file. * This file is part of multifast. * Copyright 2010-2012 Kamiar Kanani multifast is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. multifast is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with multifast. If not, see . */ #ifndef _AUTOMATA_H_ #define _AUTOMATA_H_ #include "node.h" typedef struct { /* The root of the Aho-Corasick trie */ AC_NODE_t * root; /* maintain all nodes pointers. it will be used to access or release * all nodes. */ AC_NODE_t ** all_nodes; unsigned int all_nodes_num; /* Number of all nodes in the automata */ unsigned int all_nodes_max; /* Current max allocated memory for *all_nodes */ AC_MATCH_t match; /* Any match is reported with this */ MATCH_CALBACK_f match_callback; /* Match call-back function */ /* this flag indicates that if automata is finalized by * ac_automata_finalize() or not. 1 means finalized and 0 * means not finalized (is open). after finalizing automata you can not * add pattern to automata anymore. */ unsigned short automata_open; /* It is possible to feed a large input to the automata chunk by chunk to * be searched using ac_automata_search(). in fact by default automata * thinks that all chunks are related unless you do ac_automata_reset(). * followings are variables that keep track of searching state. */ AC_NODE_t * current_node; /* Pointer to current node while searching */ unsigned long base_position; /* Represents the position of current chunk related to whole input text */ /* Statistic Variables */ unsigned long total_patterns; /* Total patterns in the automata */ } AC_AUTOMATA_t; AC_AUTOMATA_t * ac_automata_init (MATCH_CALBACK_f mc); AC_ERROR_t ac_automata_add (AC_AUTOMATA_t * thiz, AC_PATTERN_t * str); void ac_automata_finalize (AC_AUTOMATA_t * thiz); int ac_automata_search (AC_AUTOMATA_t * thiz, AC_TEXT_t * str, void * param); void ac_automata_reset (AC_AUTOMATA_t * thiz); void ac_automata_release (AC_AUTOMATA_t * thiz); void ac_automata_display (AC_AUTOMATA_t * thiz, char repcast); #endif nDPI-2.2/src/lib/third_party/include/libcache.h000066400000000000000000000062441321103654100213650ustar00rootroot00000000000000/** * libcache.h * Copyright (c) 2017 William Guglielmo Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. * */ #ifndef __DESELMO_LIBCACHE_H__ #define __DESELMO_LIBCACHE_H__ #include /** * @brief Codes representing the result of some functions * */ typedef enum cache_result { CACHE_NO_ERROR = 0, /**< Returned by a function if no error occurs. */ CACHE_CONTAINS_FALSE = 0, /**< Returned by function cache_contains if item is not present. */ CACHE_CONTAINS_TRUE, /**< Returned by function cache_contains if item is present. */ CACHE_INVALID_INPUT, /**< Returned by a function if it is called with invalid input parameters. */ CACHE_REMOVE_NOT_FOUND, /**< Returned by function cache_remove if item is not present. */ CACHE_MALLOC_ERROR /**< Returned by a function if a malloc fail. */ } cache_result; typedef struct cache *cache_t; /** * @brief Returns a new cache_t * * @par cache_max_size = max number of item that the new cache_t can contain * @return a new cache_t, or NULL if an error occurred * */ cache_t cache_new(uint32_t cache_max_size); /** * @brief Add an item in the specified cache_t * * @par cache = the cache_t * @par item = pointer to the item to add * @par item_size = size of the item * @return a code representing the result of the function * */ cache_result cache_add(cache_t cache, void *item, uint32_t item_size); /** * @brief Check if an item is in the specified cache_t * * @par cache = the cache_t * @par item = pointer to the item to check * @par item_size = size of the item * @return a code representing the result of the function * */ cache_result cache_contains(cache_t cache, void *item, uint32_t item_size); /** * @brief Remove an item in the specified cache_t * * @par cache = the cache_t * @par item = pointer to the item to remove * @par item_size = size of the item * @return a code representing the result of the function * */ cache_result cache_remove(cache_t cache, void *item, uint32_t item_size); /** * @brief Free the specified cache_t * * @par alist = the cache * */ void cache_free(cache_t cache); #endif nDPI-2.2/src/lib/third_party/include/ndpi_patricia.h000066400000000000000000000243641321103654100224440ustar00rootroot00000000000000/* * $Id: ndpi_patricia.h,v 1.6 2005/12/07 20:53:01 dplonka Exp $ * Dave Plonka * * This product includes software developed by the University of Michigan, * Merit Network, Inc., and their contributors. * * This file had been called "radix.h" in the MRT sources. * * I renamed it to "ndpi_patricia.h" since it's not an implementation of a general * radix trie. Also, pulled in various requirements from "mrt.h" and added * some other things it could be used as a standalone API. https://github.com/deepfield/MRT/blob/master/COPYRIGHT Copyright (c) 1999-2013 The Regents of the University of Michigan ("The Regents") and Merit Network, Inc. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #ifndef _NDPI_PATRICIA_H #define _NDPI_PATRICIA_H #ifndef WIN32 #define PATRICIA_IPV6 HAVE_IPV6 #else #undef PATRICIA_IPV6 #endif /* typedef unsigned int u_int; */ /* { from defs.h */ #define prefix_touchar(prefix) ((u_char *)&(prefix)->add.sin) #define MAXLINE 1024 #define BIT_TEST(f, b) ((f) & (b)) /* } */ #define addroute make_and_lookup #include /* for u_* definitions (on FreeBSD 5) */ #include /* for EAFNOSUPPORT */ #ifndef EAFNOSUPPORT # defined EAFNOSUPPORT WSAEAFNOSUPPORT #else #ifndef WIN32 # include /* for struct in_addr */ #endif #endif #ifndef WIN32 #include /* for AF_INET */ #else #include #include /* IPv6 */ #endif /* { from mrt.h */ typedef struct the_prefix4_t { unsigned short family; /* AF_INET | AF_INET6 */ unsigned short bitlen; /* same as mask? */ int ref_count; /* reference count */ struct in_addr sin; } prefix4_t; typedef struct the_prefix_t { unsigned short family; /* AF_INET | AF_INET6 */ unsigned short bitlen; /* same as mask? */ int ref_count; /* reference count */ union { struct in_addr sin; #ifdef PATRICIA_IPV6 struct in6_addr sin6; #endif /* IPV6 */ } add; } prefix_t; /* } */ /* pointer to usr data (ex. route flap info) */ union patricia_node_value_t { void *user_data; u_int32_t user_value; }; typedef struct _patricia_node_t { u_int bit; /* flag if this node used */ prefix_t *prefix; /* who we are in patricia tree */ struct _patricia_node_t *l, *r; /* left and right children */ struct _patricia_node_t *parent;/* may be used */ void *data; /* pointer to data */ union patricia_node_value_t value; } patricia_node_t; typedef struct _patricia_tree_t { patricia_node_t *head; u_int maxbits; /* for IP, 32 bit addresses */ int num_active_node; /* for debug purpose */ } patricia_tree_t; typedef void (*void_fn_t)(void *data); typedef void (*void_fn2_t)(prefix_t *prefix, void *data); /* renamed to ndpi_Patricia to avoid name conflicts */ patricia_node_t *ndpi_patricia_search_exact (patricia_tree_t *patricia, prefix_t *prefix); patricia_node_t *ndpi_patricia_search_best (patricia_tree_t *patricia, prefix_t *prefix); patricia_node_t * ndpi_patricia_search_best2 (patricia_tree_t *patricia, prefix_t *prefix, int inclusive); patricia_node_t *ndpi_patricia_lookup (patricia_tree_t *patricia, prefix_t *prefix); void ndpi_patricia_remove (patricia_tree_t *patricia, patricia_node_t *node); patricia_tree_t *ndpi_New_Patricia (int maxbits); void ndpi_Clear_Patricia (patricia_tree_t *patricia, void_fn_t func); void ndpi_Destroy_Patricia (patricia_tree_t *patricia, void_fn_t func); void ndpi_patricia_process (patricia_tree_t *patricia, void_fn2_t func); #ifdef WIN32 #define PATRICIA_MAXBITS 128 #else #define PATRICIA_MAXBITS (sizeof(struct in6_addr) * 8) #endif #define PATRICIA_NBIT(x) (0x80 >> ((x) & 0x7f)) #define PATRICIA_NBYTE(x) ((x) >> 3) #define PATRICIA_DATA_GET(node, type) (type *)((node)->data) #define PATRICIA_DATA_SET(node, value) ((node)->data = (void *)(value)) #define PATRICIA_WALK(Xhead, Xnode) \ do { \ patricia_node_t *Xstack[PATRICIA_MAXBITS+1]; \ patricia_node_t **Xsp = Xstack; \ patricia_node_t *Xrn = (Xhead); \ while ((Xnode = Xrn)) { \ if (Xnode->prefix) #define PATRICIA_WALK_ALL(Xhead, Xnode) \ do { \ patricia_node_t *Xstack[PATRICIA_MAXBITS+1]; \ patricia_node_t **Xsp = Xstack; \ patricia_node_t *Xrn = (Xhead); \ while ((Xnode = Xrn)) { \ if (1) #define PATRICIA_WALK_BREAK { \ if (Xsp != Xstack) { \ Xrn = *(--Xsp); \ } else { \ Xrn = (patricia_node_t *) 0; \ } \ continue; } #define PATRICIA_WALK_END \ if (Xrn->l) { \ if (Xrn->r) { \ *Xsp++ = Xrn->r; \ } \ Xrn = Xrn->l; \ } else if (Xrn->r) { \ Xrn = Xrn->r; \ } else if (Xsp != Xstack) { \ Xrn = *(--Xsp); \ } else { \ Xrn = (patricia_node_t *) 0; \ } \ } \ } while (0) #endif /* _NDPI_PATRICIA_H */ /************************* [newtool.gif] MRT Credits The Multi-Threaded Routing Toolkit _________________________________________________________________ MRT was developed by [1]Merit Network, Inc., under National Science Foundation grant NCR-9318902, "Experimentation with Routing Technology to be Used for Inter-Domain Routing in the Internet." Current MRT Staff * [2]Craig Labovitz * [3]Makaki Hirabaru * [4]Farnam Jahanian * Susan Hares * Susan R. Harris * Nathan Binkert * Gerald Winters Project Alumni * [5]Marc Unangst * John Scudder The BGP4+ extension was originally written by Francis Dupont . The public domain Struct C-library of linked list, hash table and memory allocation routines was developed by Jonathan Dekock . Susan Rebecca Harris provided help with the documentation. David Ward provided bug fixes and helpful suggestions. Some sections of code and architecture ideas were taken from the GateD routing daemon. The first port to Linux with IPv6 was done by Pedro Roque . Some interface routines to the Linux kernel were originally written by him. Alexey Kuznetsov made enhancements to 1.4.3a and fixed the Linux kernel interface. Linux's netlink interface was written, referring to his code "iproute2". We would also like to thank our other colleagues in Japan, Portugal, the Netherlands, the UK, and the US for their many contributions to the MRT development effort. _________________________________________________________________ Cisco is a registered trademark of Cisco Systems Inc. _________________________________________________________________ Merit Network 4251 Plymouth Road Suite C Ann Arbor, MI 48105-2785 734-764-9430 info@merit.edu _________________________________________________________________ 1999 Merit Network, Inc. [6]www@merit.edu References 1. http://www.merit.edu/ 2. http://www.merit.edu/~labovit 3. http://www.merit.edu/~masaki 4. http://www.eecs.umich.edu/~farnam 5. http://www.contrib.andrew.cmu.edu/~mju/ 6. mailto:www@merit.edu ------------ Copyright (c) 1997, 1998, 1999 The Regents of the University of Michigan ("The Regents") and Merit Network, Inc. All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. All advertising materials mentioning features or use of this software must display the following acknowledgement: This product includes software developed by the University of Michigan, Merit Network, Inc., and their contributors. 4. Neither the name of the University, Merit Network, nor the names of their contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. ************************ */ nDPI-2.2/src/lib/third_party/include/node.h000066400000000000000000000046121321103654100205550ustar00rootroot00000000000000/* * node.h: automata node header file * This file is part of multifast. * Copyright 2010-2012 Kamiar Kanani multifast is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. multifast is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with multifast. If not, see . */ #ifndef _NODE_H_ #define _NODE_H_ #include "actypes.h" /* Forward Declaration */ struct edge; /* automata node */ typedef struct ac_node { int id; /* Node ID : for debugging purpose */ short int final; /* 0: no ; 1: yes, it is a final node */ struct ac_node * failure_node; /* The failure node of this node */ unsigned short depth; /* depth: distance between this node and the root */ /* Matched patterns */ AC_PATTERN_t * matched_patterns; /* Array of matched patterns */ unsigned short matched_patterns_num; /* Number of matched patterns at this node */ unsigned short matched_patterns_max; /* Max capacity of allocated memory for matched_patterns */ /* Outgoing Edges */ struct edge * outgoing; /* Array of outgoing edges */ unsigned short outgoing_degree; /* Number of outgoing edges */ unsigned short outgoing_max; /* Max capacity of allocated memory for outgoing */ } AC_NODE_t; /* The Edge of the Node */ struct edge { AC_ALPHABET_t alpha; /* Edge alpha */ struct ac_node * next; /* Target of the edge */ }; AC_NODE_t * node_create (void); AC_NODE_t * node_create_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha); void node_register_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * str); void node_register_outgoing (AC_NODE_t * thiz, AC_NODE_t * next, AC_ALPHABET_t alpha); AC_NODE_t * node_find_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha); AC_NODE_t * node_findbs_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha); void node_release (AC_NODE_t * thiz); void node_assign_id (AC_NODE_t * thiz); void node_sort_edges (AC_NODE_t * thiz); #endif nDPI-2.2/src/lib/third_party/include/sort.h000066400000000000000000000003241321103654100206130ustar00rootroot00000000000000/* This is a function ported from the Linux kernel lib/sort.c */ void sort(void *base, size_t num, size_t len, int (*cmp_func)(const void *, const void *), void (*swap_func)(void *, void *, int size)); nDPI-2.2/src/lib/third_party/src/000077500000000000000000000000001321103654100166205ustar00rootroot00000000000000nDPI-2.2/src/lib/third_party/src/ahocorasick.c000066400000000000000000000303371321103654100212600ustar00rootroot00000000000000/* * ahocorasick.c: implementation of ahocorasick library's functions * This file is part of multifast. * Copyright 2010-2012 Kamiar Kanani multifast is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. multifast is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with multifast. If not, see . */ #include #include #include #include #include "ndpi_api.h" #include "ahocorasick.h" /* Allocation step for automata.all_nodes */ #define REALLOC_CHUNK_ALLNODES 200 /* Private function prototype */ static void ac_automata_register_nodeptr (AC_AUTOMATA_t * thiz, AC_NODE_t * node); static void ac_automata_union_matchstrs (AC_NODE_t * node); static void ac_automata_set_failure (AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas); static void ac_automata_traverse_setfailure (AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas); /****************************************************************************** * FUNCTION: ac_automata_init * Initialize automata; allocate memories and set initial values * PARAMS: * MATCH_CALBACK mc: call-back function * the call-back function will be used to reach the caller on match occurrence ******************************************************************************/ AC_AUTOMATA_t * ac_automata_init (MATCH_CALBACK_f mc) { AC_AUTOMATA_t * thiz = (AC_AUTOMATA_t *)ndpi_malloc(sizeof(AC_AUTOMATA_t)); memset (thiz, 0, sizeof(AC_AUTOMATA_t)); thiz->root = node_create (); thiz->all_nodes_max = REALLOC_CHUNK_ALLNODES; thiz->all_nodes = (AC_NODE_t **) ndpi_malloc (thiz->all_nodes_max*sizeof(AC_NODE_t *)); thiz->match_callback = mc; ac_automata_register_nodeptr (thiz, thiz->root); ac_automata_reset (thiz); thiz->total_patterns = 0; thiz->automata_open = 1; return thiz; } /****************************************************************************** * FUNCTION: ac_automata_add * Adds pattern to the automata. * PARAMS: * AC_AUTOMATA_t * thiz: the pointer to the automata * AC_PATTERN_t * patt: the pointer to added pattern * RETUERN VALUE: AC_ERROR_t * the return value indicates the success or failure of adding action ******************************************************************************/ AC_ERROR_t ac_automata_add (AC_AUTOMATA_t * thiz, AC_PATTERN_t * patt) { unsigned int i; AC_NODE_t * n = thiz->root; AC_NODE_t * next; AC_ALPHABET_t alpha; if(!thiz->automata_open) return ACERR_AUTOMATA_CLOSED; if (!patt->length) return ACERR_ZERO_PATTERN; if (patt->length > AC_PATTRN_MAX_LENGTH) return ACERR_LONG_PATTERN; for (i=0; ilength; i++) { alpha = patt->astring[i]; if ((next = node_find_next(n, alpha))) { n = next; continue; } else { next = node_create_next(n, alpha); next->depth = n->depth + 1; n = next; ac_automata_register_nodeptr(thiz, n); } } if(n->final) return ACERR_DUPLICATE_PATTERN; n->final = 1; node_register_matchstr(n, patt); thiz->total_patterns++; return ACERR_SUCCESS; } /****************************************************************************** * FUNCTION: ac_automata_finalize * Locate the failure node for all nodes and collect all matched pattern for * every node. it also sorts outgoing edges of node, so binary search could be * performed on them. after calling this function the automate literally will * be finalized and you can not add new patterns to the automate. * PARAMS: * AC_AUTOMATA_t * thiz: the pointer to the automata ******************************************************************************/ void ac_automata_finalize (AC_AUTOMATA_t * thiz) { unsigned int i; AC_ALPHABET_t *alphas; AC_NODE_t * node; if((alphas = ndpi_malloc(AC_PATTRN_MAX_LENGTH)) != NULL) { ac_automata_traverse_setfailure (thiz, thiz->root, alphas); for (i=0; i < thiz->all_nodes_num; i++) { node = thiz->all_nodes[i]; ac_automata_union_matchstrs (node); node_sort_edges (node); } thiz->automata_open = 0; /* do not accept patterns any more */ ndpi_free(alphas); } } /****************************************************************************** * FUNCTION: ac_automata_search * Search in the input text using the given automata. on match event it will * call the call-back function. and the call-back function in turn after doing * its job, will return an integer value to ac_automata_search(). 0 value means * continue search, and non-0 value means stop search and return to the caller. * PARAMS: * AC_AUTOMATA_t * thiz: the pointer to the automata * AC_TEXT_t * txt: the input text that must be searched * void * param: this parameter will be send to call-back function. it is * useful for sending parameter to call-back function from caller function. * RETURN VALUE: * -1: failed call; automata is not finalized * 0: success; continue searching; call-back sent me a 0 value * 1: success; stop searching; call-back sent me a non-0 value ******************************************************************************/ int ac_automata_search (AC_AUTOMATA_t * thiz, AC_TEXT_t * txt, void * param) { unsigned long position; AC_NODE_t *curr; AC_NODE_t *next; if(thiz->automata_open) /* you must call ac_automata_locate_failure() first */ return -1; position = 0; curr = thiz->current_node; /* This is the main search loop. * it must be keep as lightweight as possible. */ while (position < txt->length) { if(!(next = node_findbs_next(curr, txt->astring[position]))) { if(curr->failure_node /* we are not in the root node */) curr = curr->failure_node; else position++; } else { curr = next; position++; } if(curr->final && next) /* We check 'next' to find out if we came here after a alphabet * transition or due to a fail. in second case we should not report * matching because it was reported in previous node */ { thiz->match.position = position + thiz->base_position; thiz->match.match_num = curr->matched_patterns_num; thiz->match.patterns = curr->matched_patterns; /* we found a match! do call-back */ if (thiz->match_callback(&thiz->match, param)) return 1; } } /* save status variables */ thiz->current_node = curr; thiz->base_position += position; return 0; } /****************************************************************************** * FUNCTION: ac_automata_reset * reset the automata and make it ready for doing new search on a new text. * when you finished with the input text, you must reset automata state for * new input, otherwise it will not work. * PARAMS: * AC_AUTOMATA_t * thiz: the pointer to the automata ******************************************************************************/ void ac_automata_reset (AC_AUTOMATA_t * thiz) { thiz->current_node = thiz->root; thiz->base_position = 0; } /****************************************************************************** * FUNCTION: ac_automata_release * Release all allocated memories to the automata * PARAMS: * AC_AUTOMATA_t * thiz: the pointer to the automata ******************************************************************************/ void ac_automata_release (AC_AUTOMATA_t * thiz) { unsigned int i; AC_NODE_t * n; for (i=0; i < thiz->all_nodes_num; i++) { n = thiz->all_nodes[i]; node_release(n); } ndpi_free(thiz->all_nodes); ndpi_free(thiz); } /****************************************************************************** * FUNCTION: ac_automata_display * Prints the automata to output in human readable form. it is useful for * debugging purpose. * PARAMS: * AC_AUTOMATA_t * thiz: the pointer to the automata * char repcast: 'n': print AC_REP_t as number, 's': print AC_REP_t as string ******************************************************************************/ void ac_automata_display (AC_AUTOMATA_t * thiz, char repcast) { unsigned int i, j; AC_NODE_t * n; struct edge * e; AC_PATTERN_t sid; printf("---------------------------------\n"); for (i=0; iall_nodes_num; i++) { n = thiz->all_nodes[i]; printf("NODE(%3d)/----fail----> NODE(%3d)\n", n->id, (n->failure_node)?n->failure_node->id:1); for (j=0; joutgoing_degree; j++) { e = &n->outgoing[j]; printf(" |----("); if(isgraph(e->alpha)) printf("%c)---", e->alpha); else printf("0x%x)", e->alpha); printf("--> NODE(%3d)\n", e->next->id); } if (n->matched_patterns_num) { printf("Accepted patterns: {"); for (j=0; jmatched_patterns_num; j++) { sid = n->matched_patterns[j]; if(j) printf(", "); switch (repcast) { case 'n': printf("%ld", sid.rep.number); break; case 's': printf("%s", sid.rep.stringy); break; } } printf("}\n"); } printf("---------------------------------\n"); } } /****************************************************************************** * FUNCTION: ac_automata_register_nodeptr * Adds the node pointer to all_nodes. ******************************************************************************/ static void ac_automata_register_nodeptr (AC_AUTOMATA_t * thiz, AC_NODE_t * node) { if(thiz->all_nodes_num >= thiz->all_nodes_max) { thiz->all_nodes = ndpi_realloc(thiz->all_nodes, thiz->all_nodes_max*sizeof(AC_NODE_t *), (REALLOC_CHUNK_ALLNODES+thiz->all_nodes_max)*sizeof(AC_NODE_t *) ); thiz->all_nodes_max += REALLOC_CHUNK_ALLNODES; } thiz->all_nodes[thiz->all_nodes_num++] = node; } /****************************************************************************** * FUNCTION: ac_automata_union_matchstrs * Collect accepted patterns of the node. the accepted patterns consist of the * node's own accepted pattern plus accepted patterns of its failure node. ******************************************************************************/ static void ac_automata_union_matchstrs (AC_NODE_t * node) { unsigned int i; AC_NODE_t * m = node; while ((m = m->failure_node)) { for (i=0; i < m->matched_patterns_num; i++) node_register_matchstr(node, &(m->matched_patterns[i])); if (m->final) node->final = 1; } // TODO : sort matched_patterns? is that necessary? I don't think so. } /****************************************************************************** * FUNCTION: ac_automata_set_failure * find failure node for the given node. ******************************************************************************/ static void ac_automata_set_failure (AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas) { unsigned int i, j; AC_NODE_t * m; for (i=1; i < node->depth; i++) { m = thiz->root; for (j=i; j < node->depth && m; j++) m = node_find_next (m, alphas[j]); if (m) { node->failure_node = m; break; } } if (!node->failure_node) node->failure_node = thiz->root; } /****************************************************************************** * FUNCTION: ac_automata_traverse_setfailure * Traverse all automata nodes using DFS (Depth First Search), meanwhile it set * the failure node for every node it passes through. this function must be * called after adding last pattern to automata. i.e. after calling this you * can not add further pattern to automata. ******************************************************************************/ static void ac_automata_traverse_setfailure (AC_AUTOMATA_t * thiz, AC_NODE_t * node, AC_ALPHABET_t * alphas) { unsigned int i; AC_NODE_t * next; for (i=0; i < node->outgoing_degree; i++) { alphas[node->depth] = node->outgoing[i].alpha; next = node->outgoing[i].next; /* At every node look for its failure node */ ac_automata_set_failure (thiz, next, alphas); /* Recursively call itself to traverse all nodes */ ac_automata_traverse_setfailure (thiz, next, alphas); } } nDPI-2.2/src/lib/third_party/src/libcache.c000066400000000000000000000166071321103654100205300ustar00rootroot00000000000000/** * libcache.c * Copyright (c) 2017 William Guglielmo Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. * */ #include #include #include #include #include "libcache.h" // https://en.wikipedia.org/wiki/Jenkins_hash_function #define HASH_FUNCTION jenkins_one_at_a_time_hash uint32_t jenkins_one_at_a_time_hash(const uint8_t* key, size_t length) { size_t i = 0; uint32_t hash = 0; while (i != length) { hash += key[i++]; hash += hash << 10; hash ^= hash >> 6; } hash += hash << 3; hash ^= hash >> 11; hash += hash << 15; return hash; } typedef struct cache_entry *cache_entry; typedef struct cache_entry_map *cache_entry_map; struct cache { uint32_t size; uint32_t max_size; cache_entry head; cache_entry tail; cache_entry_map *map; }; struct cache_entry_map { cache_entry entry; cache_entry_map next; }; struct cache_entry { void *item; uint32_t item_size; cache_entry prev; cache_entry next; }; void cache_touch_entry(cache_t cache, cache_entry entry) { if(entry->prev) { if(entry->next) { entry->prev->next = entry->next; entry->next->prev = entry->prev; } else { entry->prev->next = NULL; cache->tail = entry->prev; } entry->prev = NULL; entry->next = cache->head; cache->head->prev = entry; cache->head = entry; } } cache_entry cache_entry_new() { return (cache_entry) calloc(sizeof(struct cache_entry), 1); } cache_entry_map cache_entry_map_new() { return (cache_entry_map) calloc(sizeof(struct cache_entry_map), 1); } cache_t cache_new(uint32_t cache_max_size) { if(!cache_max_size) { return NULL; } cache_t cache = (cache_t) calloc(sizeof(struct cache), 1); if(!cache) { return NULL; } cache->size = 0; cache->max_size = cache_max_size; cache->map = (cache_entry_map *) calloc(sizeof(cache_entry_map ), cache->max_size); if(!cache->map) { free(cache); return NULL; } return cache; } cache_result cache_add(cache_t cache, void *item, uint32_t item_size) { if(!cache || !item || !item_size) { return CACHE_INVALID_INPUT; } uint32_t hash = HASH_FUNCTION(item, item_size) % cache->max_size; if((cache->map)[hash]) { cache_entry_map hash_entry_map = cache->map[hash]; while(hash_entry_map) { if(item_size == hash_entry_map->entry->item_size && !memcmp(hash_entry_map->entry->item, item, item_size)) { break; } hash_entry_map = hash_entry_map->next; } if(hash_entry_map) { cache_touch_entry(cache, hash_entry_map->entry); return CACHE_NO_ERROR; } } cache_entry entry = cache_entry_new(); if(!entry) { return CACHE_MALLOC_ERROR; } cache_entry_map map_entry = cache_entry_map_new(); if(!map_entry) { free(entry); return CACHE_MALLOC_ERROR; } entry->item = malloc(item_size); memcpy(entry->item, item, item_size); entry->item_size = item_size; entry->prev = NULL; entry->next = cache->head; if(cache->head) cache->head->prev = entry; cache->head = entry; map_entry->entry = entry; map_entry->next = cache->map[hash]; cache->map[hash] = map_entry; if(cache->max_size > cache->size) { (cache->size)++; if(cache->size == 1) { cache->tail = entry; } } else { cache_entry tail = cache->tail; uint32_t hash = HASH_FUNCTION(tail->item, tail->item_size) % cache->max_size; if(cache->map[hash]) { cache_entry_map hash_entry_map_prev = NULL; cache_entry_map hash_entry_map = cache->map[hash]; while(hash_entry_map) { if(tail->item_size == hash_entry_map->entry->item_size && !memcmp(tail->item, hash_entry_map->entry->item, item_size)) { break; } hash_entry_map_prev = hash_entry_map; hash_entry_map = hash_entry_map->next; } if(hash_entry_map_prev) { hash_entry_map_prev->next = hash_entry_map->next; } else { cache->map[hash] = hash_entry_map->next; } tail->prev->next = NULL; cache->tail = tail->prev; free(tail->item); free(tail); free(hash_entry_map); } } return CACHE_NO_ERROR; } cache_result cache_contains(cache_t cache, void *item, uint32_t item_size) { if(!cache || !item || !item_size) { return CACHE_INVALID_INPUT; } uint32_t hash = HASH_FUNCTION(item, item_size) % cache->max_size; if(cache->map[hash]) { cache_entry_map hash_entry_map = cache->map[hash]; while(hash_entry_map) { if(item_size == hash_entry_map->entry->item_size && !memcmp(hash_entry_map->entry->item, item, item_size)) { cache_touch_entry(cache, hash_entry_map->entry); return CACHE_CONTAINS_TRUE; } hash_entry_map = hash_entry_map->next; } } return CACHE_CONTAINS_FALSE; } cache_result cache_remove(cache_t cache, void *item, uint32_t item_size) { if(!cache || !item || !item_size) { return CACHE_INVALID_INPUT; } uint32_t hash = HASH_FUNCTION(item, item_size) % cache->max_size; if(cache->map[hash]) { cache_entry_map hash_entry_map_prev = NULL; cache_entry_map hash_entry_map = cache->map[hash]; while(hash_entry_map) { if(item_size == hash_entry_map->entry->item_size && !memcmp(hash_entry_map->entry->item, item, item_size)) { break; } hash_entry_map_prev = hash_entry_map; hash_entry_map = hash_entry_map->next; } if(hash_entry_map) { if(hash_entry_map_prev) { hash_entry_map_prev->next = hash_entry_map->next; } else { cache->map[hash] = hash_entry_map->next; } cache_entry entry = hash_entry_map->entry; if(entry->prev) { entry->prev->next = entry->next; } else { cache->head = entry->next; } if(entry->next) { entry->next->prev = entry->prev; } else { cache->tail = entry->prev; } free(entry->item); free(entry); free(hash_entry_map); (cache->size)--; return CACHE_NO_ERROR; } } return CACHE_REMOVE_NOT_FOUND; } void cache_free(cache_t cache) { if(!cache) { return; } int i; for(i = 0; i < cache->max_size; i++) { cache_entry_map prev = NULL; cache_entry_map curr = cache->map[i]; while(curr) { prev = curr; curr = curr->next; free(prev->entry->item); free(prev->entry); free(prev); } } free(cache->map); free(cache); return; } nDPI-2.2/src/lib/third_party/src/ndpi_patricia.c000066400000000000000000000620301321103654100215730ustar00rootroot00000000000000/* * $Id: patricia.c,v 1.7 2005/12/07 20:46:41 dplonka Exp $ * Dave Plonka * * This product includes software developed by the University of Michigan, * Merit Network, Inc., and their contributors. * * This file had been called "radix.c" in the MRT sources. * * I renamed it to "patricia.c" since it's not an implementation of a general * radix trie. Also I pulled in various requirements from "prefix.c" and * "demo.c" so that it could be used as a standalone API. https://github.com/deepfield/MRT/blob/master/COPYRIGHT Copyright (c) 1999-2013 The Regents of the University of Michigan ("The Regents") and Merit Network, Inc. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. */ #include /* assert */ #include /* isdigit */ #include /* errno */ #include /* sin */ #include /* NULL */ #include /* sprintf, fprintf, stderr */ #include /* free, atol, calloc */ #include /* memcpy, strchr, strlen */ #include /* BSD: for inet_addr */ #ifndef WIN32 #include /* BSD, Linux: for inet_addr */ #include /* BSD, Linux: for inet_addr */ #include /* BSD, Linux, Solaris: for inet_addr */ #endif #include "ndpi_patricia.h" void ndpi_DeleteEntry(void *a) { ndpi_free(a); } /* { from prefix.c */ /* ndpi_prefix_tochar * convert prefix information to bytes */ u_char * ndpi_prefix_tochar (prefix_t * prefix) { if(prefix == NULL) return (NULL); return ((u_char *) & prefix->add.sin); } int ndpi_comp_with_mask (void *addr, void *dest, u_int mask) { uint32_t *pa = addr; uint32_t *pd = dest; uint32_t m; for(;mask >= 32; mask -= 32, pa++,pd++) if(*pa != *pd) return 0; if(!mask) return 1; m = htonl((~0u) << (32-mask)); return (*pa & m) == (*pd &m); } /* this allows incomplete prefix */ int ndpi_my_inet_pton (int af, const char *src, void *dst) { if(af == AF_INET) { int i; u_char xp[sizeof(struct in_addr)] = {0, 0, 0, 0}; for (i = 0; ; i++) { int c, val; c = *src++; if(!isdigit (c)) return (-1); val = 0; do { val = val * 10 + c - '0'; if(val > 255) return (0); c = *src++; } while (c && isdigit (c)); xp[i] = val; if(c == '\0') break; if(c != '.') return (0); if(i >= 3) return (0); } memcpy (dst, xp, sizeof(struct in_addr)); return (1); #if defined(PATRICIA_IPV6) } else if(af == AF_INET6) { return (inet_pton (af, src, dst)); #endif /* PATRICIA_IPV6 */ } else { #ifndef NT errno = EAFNOSUPPORT; #endif /* NT */ return -1; } } #define PATRICIA_MAX_THREADS 16 /* * convert prefix information to ascii string with length * thread safe and (almost) re-entrant implementation */ char * ndpi_prefix_toa2x (prefix_t *prefix, char *buff, int with_len) { if(prefix == NULL) return ((char*)"(Null)"); assert (prefix->ref_count >= 0); if(buff == NULL) { struct buffer { char buffs[PATRICIA_MAX_THREADS][48+5]; u_int i; } *buffp; # if 0 THREAD_SPECIFIC_DATA (struct buffer, buffp, 1); # else { /* for scope only */ static struct buffer local_buff; buffp = &local_buff; } # endif if(buffp == NULL) { /* XXX should we report an error? */ return (NULL); } buff = buffp->buffs[buffp->i++%PATRICIA_MAX_THREADS]; } if(prefix->family == AF_INET) { u_char *a; assert (prefix->bitlen <= sizeof(struct in_addr) * 8); a = prefix_touchar (prefix); if(with_len) { sprintf (buff, "%d.%d.%d.%d/%d", a[0], a[1], a[2], a[3], prefix->bitlen); } else { sprintf (buff, "%d.%d.%d.%d", a[0], a[1], a[2], a[3]); } return (buff); } #if defined(PATRICIA_IPV6) else if(prefix->family == AF_INET6) { char *r; r = (char *) inet_ntop (AF_INET6, &prefix->add.sin6, buff, 48 /* a guess value */ ); if(r && with_len) { assert (prefix->bitlen <= sizeof(struct in6_addr) * 8); sprintf (buff + strlen (buff), "/%d", prefix->bitlen); } return (buff); } #endif /* PATRICIA_IPV6 */ else return (NULL); } /* ndpi_prefix_toa2 * convert prefix information to ascii string */ char * ndpi_prefix_toa2 (prefix_t *prefix, char *buff) { return (ndpi_prefix_toa2x (prefix, buff, 0)); } /* ndpi_prefix_toa */ char * ndpi_prefix_toa (prefix_t * prefix) { return (ndpi_prefix_toa2 (prefix, (char *) NULL)); } prefix_t * ndpi_New_Prefix2 (int family, void *dest, int bitlen, prefix_t *prefix) { int dynamic_allocated = 0; int default_bitlen = sizeof(struct in_addr) * 8; #if defined(PATRICIA_IPV6) if(family == AF_INET6) { default_bitlen = sizeof(struct in6_addr) * 8; if(prefix == NULL) { prefix = (prefix_t*)ndpi_calloc(1, sizeof (prefix_t)); dynamic_allocated++; } memcpy (&prefix->add.sin6, dest, sizeof(struct in6_addr)); } else #endif /* PATRICIA_IPV6 */ if(family == AF_INET) { if(prefix == NULL) { #ifndef NT prefix = (prefix_t*)ndpi_calloc(1, sizeof (prefix4_t)); #else //for some reason, compiler is getting //prefix4_t size incorrect on NT prefix = ndpi_calloc(1, sizeof (prefix_t)); #endif /* NT */ dynamic_allocated++; } memcpy (&prefix->add.sin, dest, sizeof(struct in_addr)); } else { return (NULL); } prefix->bitlen = (bitlen >= 0)? bitlen: default_bitlen; prefix->family = family; prefix->ref_count = 0; if(dynamic_allocated) { prefix->ref_count++; } /* fprintf(stderr, "[C %s, %d]\n", ndpi_prefix_toa (prefix), prefix->ref_count); */ return (prefix); } prefix_t * ndpi_New_Prefix (int family, void *dest, int bitlen) { return (ndpi_New_Prefix2 (family, dest, bitlen, NULL)); } /* ndpi_ascii2prefix */ prefix_t * ndpi_ascii2prefix (int family, char *string) { long bitlen; long maxbitlen = 0; char *cp; struct in_addr sin; #if defined(PATRICIA_IPV6) struct in6_addr sin6; #endif /* PATRICIA_IPV6 */ char save[MAXLINE]; if(string == NULL) return (NULL); /* easy way to handle both families */ if(family == 0) { family = AF_INET; #if defined(PATRICIA_IPV6) if(strchr (string, ':')) family = AF_INET6; #endif /* PATRICIA_IPV6 */ } if(family == AF_INET) { maxbitlen = sizeof(struct in_addr) * 8; } #if defined(PATRICIA_IPV6) else if(family == AF_INET6) { maxbitlen = sizeof(struct in6_addr) * 8; } #endif /* PATRICIA_IPV6 */ if((cp = strchr (string, '/')) != NULL) { bitlen = atol (cp + 1); /* *cp = '\0'; */ /* copy the string to save. Avoid destroying the string */ assert (cp - string < MAXLINE); memcpy (save, string, cp - string); save[cp - string] = '\0'; string = save; if((bitlen < 0) || (bitlen > maxbitlen)) bitlen = maxbitlen; } else { bitlen = maxbitlen; } if(family == AF_INET) { if(ndpi_my_inet_pton (AF_INET, string, &sin) <= 0) return (NULL); return (ndpi_New_Prefix (AF_INET, &sin, bitlen)); } #if defined(PATRICIA_IPV6) else if(family == AF_INET6) { // Get rid of this with next IPv6 upgrade #if defined(NT) && !defined(HAVE_INET_NTOP) inet6_addr(string, &sin6); return (ndpi_New_Prefix (AF_INET6, &sin6, bitlen)); #else if(inet_pton (AF_INET6, string, &sin6) <= 0) return (NULL); #endif /* NT */ return (ndpi_New_Prefix (AF_INET6, &sin6, bitlen)); } #endif /* PATRICIA_IPV6 */ else return (NULL); } prefix_t * ndpi_Ref_Prefix (prefix_t * prefix) { if(prefix == NULL) return (NULL); if(prefix->ref_count == 0) { /* make a copy in case of a static prefix */ return (ndpi_New_Prefix2 (prefix->family, &prefix->add, prefix->bitlen, NULL)); } prefix->ref_count++; /* fprintf(stderr, "[A %s, %d]\n", ndpi_prefix_toa (prefix), prefix->ref_count); */ return (prefix); } void ndpi_Deref_Prefix (prefix_t * prefix) { if(prefix == NULL) return; /* for secure programming, raise an assert. no static prefix can call this */ assert (prefix->ref_count > 0); prefix->ref_count--; assert (prefix->ref_count >= 0); if(prefix->ref_count <= 0) { ndpi_DeleteEntry (prefix); return; } } /* #define PATRICIA_DEBUG 1 */ static int num_active_patricia = 0; /* these routines support continuous mask only */ patricia_tree_t * ndpi_New_Patricia (int maxbits) { patricia_tree_t *patricia = (patricia_tree_t*)ndpi_calloc(1, sizeof *patricia); patricia->maxbits = maxbits; patricia->head = NULL; patricia->num_active_node = 0; assert((u_int)maxbits <= PATRICIA_MAXBITS); /* XXX */ num_active_patricia++; return (patricia); } /* * if func is supplied, it will be called as func(node->data) * before deleting the node */ void ndpi_Clear_Patricia (patricia_tree_t *patricia, void_fn_t func) { assert (patricia); if(patricia->head) { patricia_node_t *Xstack[PATRICIA_MAXBITS+1]; patricia_node_t **Xsp = Xstack; patricia_node_t *Xrn = patricia->head; while (Xrn) { patricia_node_t *l = Xrn->l; patricia_node_t *r = Xrn->r; if(Xrn->prefix) { ndpi_Deref_Prefix (Xrn->prefix); if(Xrn->data && func) func (Xrn->data); } else { assert (Xrn->data == NULL); } ndpi_DeleteEntry (Xrn); patricia->num_active_node--; if(l) { if(r) { *Xsp++ = r; } Xrn = l; } else if(r) { Xrn = r; } else if(Xsp != Xstack) { Xrn = *(--Xsp); } else { Xrn = NULL; } } } assert (patricia->num_active_node == 0); /* ndpi_DeleteEntry (patricia); */ } void ndpi_Destroy_Patricia (patricia_tree_t *patricia, void_fn_t func) { ndpi_Clear_Patricia (patricia, func); ndpi_DeleteEntry (patricia); num_active_patricia--; } /* * if func is supplied, it will be called as func(node->prefix, node->data) */ void ndpi_patricia_process (patricia_tree_t *patricia, void_fn2_t func) { patricia_node_t *node; assert (func); PATRICIA_WALK (patricia->head, node) { func (node->prefix, node->data); } PATRICIA_WALK_END; } size_t ndpi_patricia_walk_inorder(patricia_node_t *node, void_fn2_t func) { size_t n = 0; assert(func); if(node->l) { n += ndpi_patricia_walk_inorder(node->l, func); } if(node->prefix) { func(node->prefix, node->data); n++; } if(node->r) { n += ndpi_patricia_walk_inorder(node->r, func); } return n; } patricia_node_t * ndpi_patricia_search_exact (patricia_tree_t *patricia, prefix_t *prefix) { patricia_node_t *node; u_char *addr; u_int bitlen; assert (patricia); assert (prefix); assert (prefix->bitlen <= patricia->maxbits); if(patricia->head == NULL) return (NULL); node = patricia->head; addr = prefix_touchar (prefix); bitlen = prefix->bitlen; while (node->bit < bitlen) { if(BIT_TEST (addr[node->bit >> 3], 0x80 >> (node->bit & 0x07))) { #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_search_exact: take right %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_search_exact: take right at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ node = node->r; } else { #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_search_exact: take left %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_search_exact: take left at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ node = node->l; } if(node == NULL) return (NULL); } #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_search_exact: stop at %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_search_exact: stop at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ if(node->bit > bitlen || node->prefix == NULL) return (NULL); assert (node->bit == bitlen); assert (node->bit == node->prefix->bitlen); if(ndpi_comp_with_mask (ndpi_prefix_tochar (node->prefix), ndpi_prefix_tochar (prefix), bitlen)) { #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_search_exact: found %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ return (node); } return (NULL); } /* if inclusive != 0, "best" may be the given prefix itself */ patricia_node_t * ndpi_patricia_search_best2 (patricia_tree_t *patricia, prefix_t *prefix, int inclusive) { patricia_node_t *node; patricia_node_t *stack[PATRICIA_MAXBITS + 1]; u_char *addr; u_int bitlen; int cnt = 0; assert (patricia); assert (prefix); assert (prefix->bitlen <= patricia->maxbits); if(patricia->head == NULL) return (NULL); node = patricia->head; addr = prefix_touchar (prefix); bitlen = prefix->bitlen; while (node->bit < bitlen) { if(node->prefix) { #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_search_best: push %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ stack[cnt++] = node; } if(BIT_TEST (addr[node->bit >> 3], 0x80 >> (node->bit & 0x07))) { #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_search_best: take right %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_search_best: take right at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ node = node->r; } else { #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_search_best: take left %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_search_best: take left at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ node = node->l; } if(node == NULL) break; } if(inclusive && node && node->prefix) stack[cnt++] = node; #ifdef PATRICIA_DEBUG if(node == NULL) fprintf (stderr, "patricia_search_best: stop at null\n"); else if(node->prefix) fprintf (stderr, "patricia_search_best: stop at %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_search_best: stop at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ if(cnt <= 0) return (NULL); while (--cnt >= 0) { node = stack[cnt]; #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_search_best: pop %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ if(ndpi_comp_with_mask (ndpi_prefix_tochar (node->prefix), ndpi_prefix_tochar (prefix), node->prefix->bitlen) && node->prefix->bitlen <= bitlen) { #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_search_best: found %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ return (node); } } return (NULL); } patricia_node_t * ndpi_patricia_search_best (patricia_tree_t *patricia, prefix_t *prefix) { return (ndpi_patricia_search_best2 (patricia, prefix, 1)); } patricia_node_t * ndpi_patricia_lookup (patricia_tree_t *patricia, prefix_t *prefix) { patricia_node_t *node, *new_node, *parent, *glue; u_char *addr, *test_addr; u_int bitlen, check_bit, differ_bit; int i, j; assert (patricia); assert (prefix); assert (prefix->bitlen <= patricia->maxbits); if(patricia->head == NULL) { node = (patricia_node_t*)ndpi_calloc(1, sizeof *node); node->bit = prefix->bitlen; node->prefix = ndpi_Ref_Prefix (prefix); node->parent = NULL; node->l = node->r = NULL; node->data = NULL; patricia->head = node; #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: new_node #0 %s/%d (head)\n", ndpi_prefix_toa (prefix), prefix->bitlen); #endif /* PATRICIA_DEBUG */ patricia->num_active_node++; return (node); } addr = prefix_touchar (prefix); bitlen = prefix->bitlen; node = patricia->head; while (node->bit < bitlen || node->prefix == NULL) { if(node->bit < patricia->maxbits && BIT_TEST (addr[node->bit >> 3], 0x80 >> (node->bit & 0x07))) { if(node->r == NULL) break; #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_lookup: take right %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_lookup: take right at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ node = node->r; } else { if(node->l == NULL) break; #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_lookup: take left %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_lookup: take left at %u\n", node->bit); #endif /* PATRICIA_DEBUG */ node = node->l; } assert (node); } assert (node->prefix); #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: stop at %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ test_addr = prefix_touchar (node->prefix); /* find the first bit different */ check_bit = (node->bit < bitlen)? node->bit: bitlen; differ_bit = 0; for (i = 0; (u_int)i*8 < check_bit; i++) { int r; if((r = (addr[i] ^ test_addr[i])) == 0) { differ_bit = (i + 1) * 8; continue; } /* I know the better way, but for now */ for (j = 0; j < 8; j++) { if(BIT_TEST (r, (0x80 >> j))) break; } /* must be found */ assert (j < 8); differ_bit = i * 8 + j; break; } if(differ_bit > check_bit) differ_bit = check_bit; #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: differ_bit %d\n", differ_bit); #endif /* PATRICIA_DEBUG */ parent = node->parent; while (parent && parent->bit >= differ_bit) { node = parent; parent = node->parent; #ifdef PATRICIA_DEBUG if(node->prefix) fprintf (stderr, "patricia_lookup: up to %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); else fprintf (stderr, "patricia_lookup: up to %u\n", node->bit); #endif /* PATRICIA_DEBUG */ } if(differ_bit == bitlen && node->bit == bitlen) { if(node->prefix) { #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: found %s/%d\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ return (node); } node->prefix = ndpi_Ref_Prefix (prefix); #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: new node #1 %s/%d (glue mod)\n", ndpi_prefix_toa (prefix), prefix->bitlen); #endif /* PATRICIA_DEBUG */ assert (node->data == NULL); return (node); } new_node = (patricia_node_t*)ndpi_calloc(1, sizeof *new_node); if(!new_node) return NULL; new_node->bit = prefix->bitlen; new_node->prefix = ndpi_Ref_Prefix (prefix); new_node->parent = NULL; new_node->l = new_node->r = NULL; new_node->data = NULL; patricia->num_active_node++; if(node->bit == differ_bit) { new_node->parent = node; if(node->bit < patricia->maxbits && BIT_TEST (addr[node->bit >> 3], 0x80 >> (node->bit & 0x07))) { assert (node->r == NULL); node->r = new_node; } else { assert (node->l == NULL); node->l = new_node; } #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: new_node #2 %s/%d (child)\n", ndpi_prefix_toa (prefix), prefix->bitlen); #endif /* PATRICIA_DEBUG */ return (new_node); } if(bitlen == differ_bit) { if(bitlen < patricia->maxbits && BIT_TEST (test_addr[bitlen >> 3], 0x80 >> (bitlen & 0x07))) { new_node->r = node; } else { new_node->l = node; } new_node->parent = node->parent; if(node->parent == NULL) { assert (patricia->head == node); patricia->head = new_node; } else if(node->parent->r == node) { node->parent->r = new_node; } else { node->parent->l = new_node; } node->parent = new_node; #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: new_node #3 %s/%d (parent)\n", ndpi_prefix_toa (prefix), prefix->bitlen); #endif /* PATRICIA_DEBUG */ } else { glue = (patricia_node_t*)ndpi_calloc(1, sizeof *glue); if(!glue) return(NULL); glue->bit = differ_bit; glue->prefix = NULL; glue->parent = node->parent; glue->data = NULL; patricia->num_active_node++; if(differ_bit < patricia->maxbits && BIT_TEST (addr[differ_bit >> 3], 0x80 >> (differ_bit & 0x07))) { glue->r = new_node; glue->l = node; } else { glue->r = node; glue->l = new_node; } new_node->parent = glue; if(node->parent == NULL) { assert (patricia->head == node); patricia->head = glue; } else if(node->parent->r == node) { node->parent->r = glue; } else { node->parent->l = glue; } node->parent = glue; #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_lookup: new_node #4 %s/%d (glue+node)\n", ndpi_prefix_toa (prefix), prefix->bitlen); #endif /* PATRICIA_DEBUG */ } return (new_node); } void ndpi_patricia_remove (patricia_tree_t *patricia, patricia_node_t *node) { patricia_node_t *parent, *child; assert (patricia); assert (node); if(node->r && node->l) { #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_remove: #0 %s/%d (r & l)\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ /* this might be a placeholder node -- have to check and make sure * there is a prefix associated with it ! */ if(node->prefix != NULL) ndpi_Deref_Prefix (node->prefix); node->prefix = NULL; /* Also I needed to clear data pointer -- masaki */ node->data = NULL; return; } if(node->r == NULL && node->l == NULL) { #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_remove: #1 %s/%d (!r & !l)\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ parent = node->parent; ndpi_Deref_Prefix (node->prefix); ndpi_DeleteEntry (node); patricia->num_active_node--; if(parent == NULL) { assert (patricia->head == node); patricia->head = NULL; return; } if(parent->r == node) { parent->r = NULL; child = parent->l; } else { assert (parent->l == node); parent->l = NULL; child = parent->r; } if(parent->prefix) return; /* we need to remove parent too */ if(parent->parent == NULL) { assert (patricia->head == parent); patricia->head = child; } else if(parent->parent->r == parent) { parent->parent->r = child; } else { assert (parent->parent->l == parent); parent->parent->l = child; } child->parent = parent->parent; ndpi_DeleteEntry (parent); patricia->num_active_node--; return; } #ifdef PATRICIA_DEBUG fprintf (stderr, "patricia_remove: #2 %s/%d (r ^ l)\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); #endif /* PATRICIA_DEBUG */ if(node->r) { child = node->r; } else { assert (node->l); child = node->l; } parent = node->parent; child->parent = parent; ndpi_Deref_Prefix (node->prefix); ndpi_DeleteEntry (node); patricia->num_active_node--; if(parent == NULL) { assert (patricia->head == node); patricia->head = child; return; } if(parent->r == node) { parent->r = child; } else { assert (parent->l == node); parent->l = child; } } /* { from demo.c */ #if 0 patricia_node_t * ndpi_make_and_lookup (patricia_tree_t *tree, char *string) { prefix_t *prefix; patricia_node_t *node; prefix = ndpi_ascii2prefix (AF_INET, string); printf ("make_and_lookup: %s/%d\n", ndpi_prefix_toa (prefix), prefix->bitlen); node = ndpi_patricia_lookup (tree, prefix); ndpi_Deref_Prefix (prefix); return (node); } patricia_node_t * ndpi_try_search_exact (patricia_tree_t *tree, char *string) { prefix_t *prefix; patricia_node_t *node; prefix = ndpi_ascii2prefix (AF_INET, string); printf ("try_search_exact: %s/%d\n", ndpi_prefix_toa (prefix), prefix->bitlen); if((node = patricia_search_exact (tree, prefix)) == NULL) { printf ("try_search_exact: not found\n"); } else { printf ("try_search_exact: %s/%d found\n", ndpi_prefix_toa (node->prefix), node->prefix->bitlen); } ndpi_Deref_Prefix (prefix); return (node); } void ndpi_lookup_then_remove (patricia_tree_t *tree, char *string) { patricia_node_t *node; if((node = try_search_exact (tree, string))) patricia_remove (tree, node); } #endif nDPI-2.2/src/lib/third_party/src/node.c000066400000000000000000000207651321103654100177230ustar00rootroot00000000000000/* * node.c: implementation of automata node * This file is part of multifast. * Copyright 2010-2012 Kamiar Kanani multifast is free software: you can redistribute it and/or modify it under the terms of the GNU Lesser General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. multifast is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more details. You should have received a copy of the GNU Lesser General Public License along with multifast. If not, see . */ #include #include #include #include "ndpi_api.h" #include "../include/node.h" #include "sort.h" /* reallocation step for AC_NODE_t.matched_patterns */ #define REALLOC_CHUNK_MATCHSTR 8 /* reallocation step for AC_NODE_t.outgoing array */ #define REALLOC_CHUNK_OUTGOING 8 /* TODO: For different depth of node, number of outgoing edges differs considerably, It is efficient to use different chunk size for different depths */ /* Private function prototype */ void node_init (AC_NODE_t * thiz); int node_edge_compare (const void * l, const void * r); int node_has_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * newstr); /****************************************************************************** * FUNCTION: node_create * Create the node ******************************************************************************/ AC_NODE_t * node_create(void) { AC_NODE_t * thiz = (AC_NODE_t *) ndpi_malloc (sizeof(AC_NODE_t)); node_init(thiz); node_assign_id(thiz); return thiz; } /****************************************************************************** * FUNCTION: node_init * Initialize node ******************************************************************************/ void node_init(AC_NODE_t * thiz) { memset(thiz, 0, sizeof(AC_NODE_t)); thiz->outgoing_max = REALLOC_CHUNK_OUTGOING; thiz->outgoing = (struct edge *) ndpi_malloc (thiz->outgoing_max*sizeof(struct edge)); thiz->matched_patterns_max = REALLOC_CHUNK_MATCHSTR; thiz->matched_patterns = (AC_PATTERN_t *) ndpi_malloc (thiz->matched_patterns_max*sizeof(AC_PATTERN_t)); } /****************************************************************************** * FUNCTION: node_release * Release node ******************************************************************************/ void node_release(AC_NODE_t * thiz) { ndpi_free(thiz->matched_patterns); ndpi_free(thiz->outgoing); ndpi_free(thiz); } /****************************************************************************** * FUNCTION: node_find_next * Find out the next node for a given Alpha to move. this function is used in * the pre-processing stage in which edge array is not sorted. so it uses * linear search. ******************************************************************************/ AC_NODE_t * node_find_next(AC_NODE_t * thiz, AC_ALPHABET_t alpha) { int i; for (i=0; i < thiz->outgoing_degree; i++) { if(thiz->outgoing[i].alpha == alpha) return (thiz->outgoing[i].next); } return NULL; } /****************************************************************************** * FUNCTION: node_findbs_next * Find out the next node for a given Alpha. this function is used after the * pre-processing stage in which we sort edges. so it uses Binary Search. ******************************************************************************/ AC_NODE_t * node_findbs_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha) { int min, max, mid; AC_ALPHABET_t amid; min = 0; max = thiz->outgoing_degree - 1; while (min <= max) { mid = (min+max) >> 1; amid = thiz->outgoing[mid].alpha; if (alpha > amid) min = mid + 1; else if (alpha < amid) max = mid - 1; else return (thiz->outgoing[mid].next); } return NULL; } /****************************************************************************** * FUNCTION: node_has_matchstr * Determine if a final node contains a pattern in its accepted pattern list * or not. return values: 1 = it has, 0 = it hasn't ******************************************************************************/ int node_has_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * newstr) { int i, j; AC_PATTERN_t * str; for (i=0; i < thiz->matched_patterns_num; i++) { str = &thiz->matched_patterns[i]; if (str->length != newstr->length) continue; for (j=0; j<(int)str->length; j++) if(str->astring[j] != newstr->astring[j]) continue; if (j == str->length) return 1; } return 0; } /****************************************************************************** * FUNCTION: node_create_next * Create the next node for the given alpha. ******************************************************************************/ AC_NODE_t * node_create_next (AC_NODE_t * thiz, AC_ALPHABET_t alpha) { AC_NODE_t * next; next = node_find_next (thiz, alpha); if (next) /* The edge already exists */ return NULL; /* Otherwise register new edge */ next = node_create (); node_register_outgoing(thiz, next, alpha); return next; } /****************************************************************************** * FUNCTION: node_register_matchstr * Adds the pattern to the list of accepted pattern. ******************************************************************************/ void node_register_matchstr (AC_NODE_t * thiz, AC_PATTERN_t * str) { /* Check if the new pattern already exists in the node list */ if (node_has_matchstr(thiz, str)) return; /* Manage memory */ if (thiz->matched_patterns_num >= thiz->matched_patterns_max) { thiz->matched_patterns = (AC_PATTERN_t *) ndpi_realloc (thiz->matched_patterns, thiz->matched_patterns_max*sizeof(AC_PATTERN_t), (REALLOC_CHUNK_MATCHSTR+thiz->matched_patterns_max)*sizeof(AC_PATTERN_t)); thiz->matched_patterns_max += REALLOC_CHUNK_MATCHSTR; } thiz->matched_patterns[thiz->matched_patterns_num].astring = str->astring; thiz->matched_patterns[thiz->matched_patterns_num].length = str->length; thiz->matched_patterns[thiz->matched_patterns_num].rep = str->rep; thiz->matched_patterns_num++; } /****************************************************************************** * FUNCTION: node_register_outgoing * Establish an edge between two nodes ******************************************************************************/ void node_register_outgoing (AC_NODE_t * thiz, AC_NODE_t * next, AC_ALPHABET_t alpha) { if(thiz->outgoing_degree >= thiz->outgoing_max) { thiz->outgoing = (struct edge *) ndpi_realloc (thiz->outgoing, thiz->outgoing_max*sizeof(struct edge), (REALLOC_CHUNK_OUTGOING+thiz->outgoing_max)*sizeof(struct edge)); thiz->outgoing_max += REALLOC_CHUNK_OUTGOING; } thiz->outgoing[thiz->outgoing_degree].alpha = alpha; thiz->outgoing[thiz->outgoing_degree++].next = next; } /****************************************************************************** * FUNCTION: node_assign_id * assign a unique ID to the node (used for debugging purpose). ******************************************************************************/ void node_assign_id (AC_NODE_t * thiz) { static int unique_id = 1; thiz->id = unique_id ++; } /****************************************************************************** * FUNCTION: node_edge_compare * Comparison function for qsort. see man qsort. ******************************************************************************/ int node_edge_compare (const void * l, const void * r) { /* According to man page: * The comparison function must return an integer less than, equal to, or * greater than zero if the first argument is considered to be * respectively less than, equal to, or greater than the second. if two * members compare as equal, their order in the sorted array is undefined. * * NOTE: Because edge alphabets are unique in every node we ignore * equivalence case. **/ if ( ((struct edge *)l)->alpha >= ((struct edge *)r)->alpha ) return 1; else return -1; } /****************************************************************************** * FUNCTION: node_sort_edges * sorts edges alphabets. ******************************************************************************/ void node_sort_edges (AC_NODE_t * thiz) { sort ((void *)thiz->outgoing, thiz->outgoing_degree, sizeof(struct edge), node_edge_compare, NULL); } nDPI-2.2/src/lib/third_party/src/sort.c000066400000000000000000000043421321103654100177560ustar00rootroot00000000000000/* * A fast, small, non-recursive O(nlog n) sort for the Linux kernel * * Jan 23 2005 Matt Mackall */ #ifdef WIN32 #include typedef uint32_t u_int32_t; #endif #include #include #include /* This is a function ported from the Linux kernel lib/sort.c */ static void u_int32_t_swap(void *a, void *b, int size) { u_int32_t t = *(u_int32_t *)a; *(u_int32_t *)a = *(u_int32_t *)b; *(u_int32_t *)b = t; } static void generic_swap(void *_a, void *_b, int size) { char t; char *a = (char*)_a; char *b = (char*)_b; do { t = *a; *a++ = *b; *b++ = t; } while (--size > 0); } /** * sort - sort an array of elements * @base: pointer to data to sort * @num: number of elements * @size: size of each element * @cmp_func: pointer to comparison function * @swap_func: pointer to swap function or NULL * * This function does a heapsort on the given array. You may provide a * swap_func function optimized to your element type. * * Sorting time is O(n log n) both on average and worst-case. While * qsort is about 20% faster on average, it suffers from exploitable * O(n*n) worst-case behavior and extra memory requirements that make * it less suitable for kernel use. */ void sort(void *_base, size_t num, size_t size, int (*cmp_func)(const void *, const void *), void (*swap_func)(void *, void *, int size)) { /* pre-scale counters for performance */ int i = (num/2 - 1) * size, n = num * size, c, r; char *base = (char*)_base; if (!swap_func) swap_func = (size == 4 ? u_int32_t_swap : generic_swap); /* heapify */ for ( ; i >= 0; i -= size) { for (r = i; r * 2 + size < n; r = c) { c = r * 2 + size; if (c < n - size && cmp_func(base + c, base + c + size) < 0) c += size; if (cmp_func(base + r, base + c) >= 0) break; swap_func(base + r, base + c, size); } } /* sort */ for (i = n - size; i > 0; i -= size) { swap_func(base, base + i, size); for (r = 0; r * 2 + size < i; r = c) { c = r * 2 + size; if (c < i - size && cmp_func(base + c, base + c + size) < 0) c += size; if (cmp_func(base + r, base + c) >= 0) break; swap_func(base + r, base + c, size); } } } nDPI-2.2/tests/000077500000000000000000000000001321103654100133055ustar00rootroot00000000000000nDPI-2.2/tests/Makefile.am000066400000000000000000000000561321103654100153420ustar00rootroot00000000000000TESTS = do.sh EXTRA_DIST = do.sh pcap result nDPI-2.2/tests/do.sh000077500000000000000000000013301321103654100142430ustar00rootroot00000000000000READER="../example/ndpiReader -p ../example/protos.txt" RC=0 PCAPS=`cd pcap; /bin/ls *.pcap` build_results() { for f in $PCAPS; do #echo $f # create result files if not present [ ! -f result/$f.out ] && $READER -q -i pcap/$f -w result/$f.out -v 1 done } check_results() { for f in $PCAPS; do if [ -f result/$f.out ]; then CMD="$READER -q -i pcap/$f -w /tmp/reader.out -v 1" $CMD NUM_DIFF=`diff result/$f.out /tmp/reader.out | wc -l` if [ $NUM_DIFF -eq 0 ]; then printf "%-32s\tOK\n" "$f" else printf "%-32s\tERROR\n" "$f" echo "$CMD" diff result/$f.out /tmp/reader.out RC=1 fi /bin/rm /tmp/reader.out fi done } build_results check_results exit $RC nDPI-2.2/tests/pcap/000077500000000000000000000000001321103654100142305ustar00rootroot00000000000000nDPI-2.2/tests/pcap/1kxun.pcap000066400000000000000000024553001321103654100161540ustar00rootroot00000000000000 M<++32-bit Windows 7 Service Pack 1, build 76014Dumpcap 1.12.8 (v1.12.8-0-g5b6e543 from master-1.12)2\Device\NPF_{15654670-BEA4-4E9C-8E97-E65EC6E00553}  +32-bit Windows 7 Service Pack 1, build 7601d 9 XDD^H$c1E6:\,")jason-PCdd 9hXDD^H$c1E6:[,")jason-PCd 9X^^RE0Y9lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9DX^H$c1E:,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 x 9XVVL^ eEHqwCD4 R$$w&ZcUcSc56w3<w__*_ {-txd 9`YBBL^ e`GE4d2@@jDeP7^J(s d 9qY^oEAa2lRM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9ۃY^H$c E~d)láM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9}X Y^^RE09lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9!Y^H$c1E:,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 x 9!YVVp>EHDC4[p>cSc57yw9=p>23v Shenx 9)Ybb33p>`a,UdS%"#,h 'sp>x 9/YVVL^ eEHqwCD4hVVwӣpcSc56w3<w__*_ {-txx 9-6YVV33=` $  RO_X1Cxd 9.6YBB^=E4-/ fRO_X1Cd 9/6Y^=E@/kldM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 ` 9~7Y@@^Bp1E2QSMs`^wpad`` 97Y@@^Bp1E2QSMs`^wpad`p 97YPPL^ eBp1EBQ(sP5.,jpkankan1kxunmobipp 9%7YPPL^ eBp1EBQ(sP5.,jpkankan1kxunmobip 97YppBp1L^ eEb8.s5PNe,jpkankan1kxunmobi +j#n +j#pd 98YBBL^ eBp1E4Q@'sj#nP=XQ` =:dd 98YBBL^ eBp1E4Q@'sj#nP=XQ` =:dd 98YBBBp1L^ eE4@6j#nsPs=XQar[dX 98Y66L^ eBp1E(Q@2sj#nP=XQasP XX 98Y66L^ eBp1E(Q@2sj#nP=XQasP X 9%8YL^ eBp1EQ@sj#nP=XQasPUGET /api/videos/10410.json?callback=jQuery18306855657112319022_1470103242123&_=1470104377698 HTTP/1.1 Host: jp.kankan.1kxun.mobi Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9V8YL^ eBp1EQ@sj#nP=XQasPUGET /api/videos/10410.json?callback=jQuery18306855657112319022_1470103242123&_=1470104377698 HTTP/1.1 Host: jp.kankan.1kxun.mobi Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8 ` 9&9Y@@^Bp1E2QSGs`^wpad`` 9F9Y@@^Bp1E2QSGs`^wpad` 9N9Ybb33p>`a,UdS%"#, 'sp>dx 9O9YVVL^ eEHqwCD4a1c  wp*cSc56w3<w__x\ 9t9Y<<Bp1L^ eE(; @6Gj#nsPs=XRP \ 99YBp1L^ eE; @6C)j#nsPs=XRP3HTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:20:04 GMT Content-Type: application/x-javascript Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: Express Content-Encoding: gzip 3d8 T]of+6m0.7i.w]U1s"lfMHڦ|*$! kja6`F@>99>?j\a2g((:L-4"1"t EeUM!q(DH*K$BHPd"ZxdżyVSIV MR%2D1_QM @xIP$9Q H!"irX]\HWYya S*'#T`‰2܍XdRdV$L1"vȭ*r9FG!wy x+d=O*%B!IZ.ȉP^HbrrSB?Kj6\@ jE[T:A& N$/Gs\ղս=Wҿcm 41NȬ5`{Aۭ׸y۷ead6q `yo}{D/څz@7pٯPe˼k[q4.͋60[u:zհ7vѨlFC+j+l:95dJ[仌y>1˩ d2qh@ȱY *Qo:GS8LWzovmU^ǑѰ%oR1rlƇ+џ :t@ G1 f'=2}L.}FlOP5>݊]nw*/u2Rw]c7977n M 2`8|~V_ǭ]A`ʬ]NiOљYY s&RÛlFT¶pJɰxw=yg)M[Y]:ݲw `FLJc JD+ëy_ɸy 2}öj0꼶_KQ9 cزKkt+2of˵( dӢmvyO׿52H#7 0 l 9?:YLLL^ eBp1E>Q&s5*Q4qkankan1kxuncomll 9 @:YLLL^ eBp1E>Q&s5*Q4qkankan1kxuncoml\ 9B;Y<<#`GE(K@@sKvև)*P <\\ 9;Y<<Bp1#E(@@A$sKv)*ևPF\\| 9Q s_5*qkankan1kxuncomll 9eIYLLL^ eBp1E>Q s_5*qkankan1kxuncoml 9ˑIYllBp1L^ eE^bP_s5Jq偀kankan1kxuncom 3I 3Iqd 9IYBBL^ eBp1E4Q@SsIP3@o Qdd 9IYBBL^ eBp1E4Q@SsIP3@o Qd 9SJYllBp1L^ eE^I?0s5Jq偀kankan1kxuncom WIq WI 9JY^oEA`2lRM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9JY^H$c E~ `)láM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 d 9JYBBBp1L^ eE4@19"IsP{3@pFYdX 9ɒJY66L^ eBp1E(Q@]sIP3@p|PXX 9JY66L^ eBp1E(Q@]sIP3@p|PX 9JYL^ eBp1EQ@sIP3@p|PcKGET /api/videos/alsolikes/10410.json?callback=jQuery18306855657112319022_1470103242123&_=1470104377899 HTTP/1.1 Host: kankan.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9JYL^ eBp1EQ@sIP3@p|PcKGET /api/videos/alsolikes/10410.json?callback=jQuery18306855657112319022_1470103242123&_=1470104377899 HTTP/1.1 Host: kankan.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8 \ 9KY<<Bp1L^ eE(@1X{IsP|3BP6!\4 9KYBp1L^ eE@1UIsP|3BP6HTTP/1.1 200 OK Server: openresty/1.9.3.2 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: application/json;charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/7.0.1 Access-Control-Allow-Origin: * Content-Encoding: gzip 1cc n ߅VZE**on7Q޽ #Ε,l0pKUFJ%5c?0)ҧW6兜ɒB$%od 7p iH׈\&@}t.]VR29?RNO~:ɝ~!>? ҕS,NB7o/c-a|QYD-YĈyԆhaL)Q7:4 LӦ83+[90Y~$/;)^M ]AhQ8͘nu% k.|u"B3Ht+*ۜ.|/ms;To2u 0 4l 9*LYIIL^ eBp1E;Qs45'()pic1kxuncomll 9cLYIIL^ eBp1E;Qs45'()pic1kxuncoml 9LYBp1L^ eE{.0s54g)pic1kxuncom Wj# WǺ Wo Wj:d 9LYBBL^ eBp1E4Q@sj#PE odd 9LYBBL^ eBp1E4Q@sj#PE odd 9LYBBL^ eBp1E4Q@sj#P&Y $dd 9LYBBL^ eBp1E4Q@sj#P&Y $dd 9[LYBBL^ eBp1E4Q@sj#Pڽ Ֆdd 9uLYBBL^ eBp1E4Q@sj#Pڽ Ֆdd 9LYBBL^ eBp1E4Q@sj#P dd 9LYBBL^ eBp1E4Q@sj#P dd 9|LYBBL^ eBp1E4Q@sj#PȈ\ $}dd 9LYBBL^ eBp1E4Q@sj#PȈ\ $}dd 9LYBBL^ eBp1E4Q@sj#P솵 1dd 9 LYBBL^ eBp1E4Q@sj#P솵 1d| 9aMY\\332,`&鏺kh&  小佛專機|h 9MYHH^2,E:+_h&  小佛專機hd 9MYBBBp1L^ eE4@6bj#sPzB&ZrdX 9nMY66L^ eBp1E(Q@sj#P&ZzBPQXX 9MY66L^ eBp1E(Q@sj#P&ZzBPQXd 9MYBBBp1L^ eE4@6bj#sPć솶r<dX 9MY66L^ eBp1E(Q@sj#P솶PmXX 9MY66L^ eBp1E(Q@sj#P솶PmXd 9MYBBBp1L^ eE4@6bj#sPzڽr dX 9vMY66L^ eBp1E(Q@sj#PڽzPqXX 9MY66L^ eBp1E(Q@sj#PڽzPqXd 9MYBBBp1L^ eE4@6bj#sP%mEr{@dX 9MY66L^ eBp1E(Q@sj#PE%nP-XX 9)MY66L^ eBp1E(Q@sj#PE%nP-Xd 9MYBBBp1L^ eE4@6bj#sPV1r}!dX 9MY66L^ eBp1E(Q@sj#PV1P/XX 9ϩMY66L^ eBp1E(Q@sj#PV1P/Xd 9IMYBBBp1L^ eE4@6bj#sPI{,Ȉ]rAdX 9MY66L^ eBp1E(Q@sj#PȈ]I{-PXX 9ϪMY66L^ eBp1E(Q@sj#PȈ]I{-PX 9MYL^ eBp1EQ@#sj#P&ZzBPGET /video_kankan/images/videos/18283-jfyj3.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@#sj#PE%nPGET /video_kankan/images/videos/13480-alps.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9,MYL^ eBp1EQ@#sj#P&ZzBPGET /video_kankan/images/videos/18283-jfyj3.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9,MYL^ eBp1EQ@#sj#PE%nPGET /video_kankan/images/videos/13480-alps.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@#sj#P솶P_GET /video_kankan/images/videos/4657-jfyj.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@"sj#PڽzPGET /video_kankan/images/videos/3578-ywzj.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@"sj#PڽzPGET /video_kankan/images/videos/3578-ywzj.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@#sj#P솶P_GET /video_kankan/images/videos/4657-jfyj.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@"sj#PV1PGET /video_kankan/images/videos/3713-ydm.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9?MYL^ eBp1EQ@"sj#PV1PGET /video_kankan/images/videos/3713-ydm.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@sj#PȈ]I{-PeGET /video_kankan/images/videos/16649-ljdz.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9MYL^ eBp1EQ@sj#PȈ]I{-PeGET /video_kankan/images/videos/16649-ljdz.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8 \ 94ZNY<<Bp1L^ eE(@6zTj#sPzڽyP \ 9WNYuuBp1L^ eEg@6yj#sPzڽyPHTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 29027 Last-Modified: Fri, 21 Oct 2011 04:26:59 GMT Connection: keep-alive ETag: "4ea0f493-7163" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes \ 9ۇNY<<Bp1L^ eE(C@6*j#sPzB&PP3\\ 9NY<<Bp1L^ eE(Q@6tj#sPćPk\ 9NYuuBp1L^ eEgR@6rj#sPćPTuHTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 23558 Last-Modified: Tue, 29 Nov 2011 01:53:54 GMT Connection: keep-alive ETag: "4ed43b32-5c06" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes D 95NY""Bp1L^ eES@6o/j#sPć)P*JFIFHHC     C    C!1AQa"q2B#Rb3rC$ 5c>!1A"Qa2qB#3Rbr$D ?^yvmXcgCWW&Z43;rmɵ|u"&vG!eXLUL6uR- q/#(v4q\s [i!+O̕AS1ԨMhWbXRȲt&_M9AOR@F }{}F'z/$S{?ptmk|皘=tE;-,qnN#,iXێŊPjRڋ-jzcD cVnpZ&aw=*ٞk1E3i I"fmaf~zMct&& mؖ`A& yt- 0]l] \yaFk͒eiS=*{ -eI*2Xe9IYB7b&K•EEۏ/L@' `ʫvbv bI(3D<C J1ܰ\w"TOP$2R:lJ[ a&jt""<\>I%S[RmoSl\ਨ:ۅqii>P1z^n;Ⱥ.IGA42broVjyy7ep w'zK+_VdBa_e⻢nr}r.pmE΂YhkZ3r$q)b15Z|,B cs~xzT@/#%d$_4Tl+ bNx3VyFJ*ƒGzyY[+H͇78 DڵVܱ' M&i*O:DD 9jNY""Bp1L^ eET@6o.j#sPćP ";?b QXXvPTzBLRQ\k#9۸zb62$] D~va]5йިD9nY֪,UKKN V!)H\ƞ AAeJVIi#i|WAkrx(iIBq+MV"8YFqU,#?VLkj"^7Nu-T~+VeY=BId7n-qK%$t2oPz;MT0-p,5*c,T) 7X' []#'Ӡ|~&Ifg9f+cLjc|"B{6gf m`3L:RGVTj 2exdmCH Vw\_eJ[xYP̆Pey>e8XGHJKDӆ)oX@` *ӄ4b VBK*H`Fb\_UmoGsWel]PQfY_ r%xF)BKN!ì%j*YNOY&tuNqC\Q=uxв7Md\#Bԉ[5jEgT5E4l|\تio3TvoGkI9!#+y24Ծ,%S32m]XNKӞ˖Keݳ전zBSy%qW'*:8m`L8 N@y_8GoLD$ &7Sy jο_e!q(|Umj>QP}aR,5Ujd7౶= KP'y%ت)vʥ>+_75hK0l;AM@ 28 B<3rk隖"?ɒŊ+cMA](qb%էR7Z; Ll,-,)1qxcҚVOOU+On=&, 0,b+Ly-dOMBd7W|V13F̪$J_i$Bpդ,NI>(-Z-ysa{17'ߙ"sd53J÷a4ߙ0caʜJvOyzT hR@rhCZPWф$/>X C+iH?LBc5UCs+Ζ+F/EU&eNeXd92&a\DD 9NY""Bp1L^ eEU@6o-j#sPćP m &2}b\=1p7p uvZb/yսN\NgT ʩ#X1(ĕq:ԓCCݺ(ڌvd`MQ3b8x!0$ 󣃤u+I*XU GgarԛU0ƞ| X!ܛs|Q-4G3뱦ӱ%u9UfJt/&zn1v'|*kG8N5\|0z4IP{ ;'VJ?E6物6!]#]T Cpw(+x;oEskf:-c"!Uqx_@OτzNH+#14s1*G_L: Ek5TFrw,MC`oDzy+FĂc~re0 49RJ 35 ˏ?Qsv6Ǚ #|*zHPQ5 l8#ܑ|)Mg.X1:~ $xsF73rO{[# mslLL UgVXUp^2OG߆&8U H#Oi9*2l1 (M3 x)vrTJo(.-IPťw_b[  -}8&}p[PUpaj%-TWG ahZʱOKF ^ֺM 'U\?5/p ORQmIy(ؑŽa>!w5S -b@b4in|1xPK qrE _ig3F{.T`4鋍k0a,!"ď}357si8k7_aV̿-or@#LzNDC`yϐ!NVk{ʇ3qqUۉtV"29XB&1z|&@}U,-wB'74v4RPAuoxz7HH3jJy }lEmypG R5%;(+ćUiI*zCZ76}G"=>_7WWEiNL BX$߷݊/SPj (5>p3#*DD 9NY""Bp1L^ eEV@6o,j#sPćPuu_थTN)|0kOjxj2*zO§]v GŸJԙT6qUYGMNR)т# ' @5z[$X jUSTVek p?Pw6Ǔ Z"*œOPxK-ƶ `=0ZJJ ʕX\B] kw="{B~hu>2u"WWH|pkȱ*Zip?S.zԙuAI[8'6Iou#ƿ\u÷Y (9Uy&'-f2t;IRʧkJBb GJL =̾UOd矞4,)JIQi1`^6HgXb\LFEeR{n$N%E'c?Mހu&RSV5MK"w2FAp\3IIlʩYAAf&sWTz5S٬jWu}ߪz1MGjZ[hdʼnRv7B%J=$jutȥvw?ty[Uo(FXIIQq>32AQSp'{΂UU#yex/Žq:$mۙS&P)~X<tD.mf^ Td2e :s db\BASp ]*>#0h?S%+Aj0G[Z2u&G0ε&g~dyQ J-A8FO^dF-/,?~ssA|c/i4؜2,NAk%i1}CK[^$KFUas(s\ڶÁIn]`js"Ҷ6\1~7F23ϝcY)}mPH?f#,|RQUA F7(S{~p,Jr/Än7ψh ~!k ш*lgDD 9xNY""Bp1L^ eE@6ufj#sPzڽyPJFIF``C     C    N!1"AQaq2 #Bb$3Rr%C(46Scdes6!1A"Qa2#q3BRbr ?e)nFΈ?T,L>zB=I5WI&s.EI=Ӌ2]V~->LVbL4X}-Gil84-GhY? ʻ@?Pb47>Қ܋"ZëXF#QT3i- 8ZFszvV:ebG]TTTHHXt8f !IqĘ%#q#^OllDkkSh.Q*-\~txζxƍei%R![vw`3p ww=Z,iժtYҾM436 j,4:S,a̳QPJWZrcN ;it"꒑6=xd'Ff#!w:%JIg,Y|aj$%½[C<*v-:Cyk6z,mv9.kvRZӈh0T)%;ZSH1RܨIPꟍSO O 2B@ $mW#DuBIXĂmu,o,! * eJ<tbIttǣKO6J]K8 K’%dy* H\D&6*5Xk[Q eili d);{MPNԵG{NTZFe, RE68[mEZtKP9G:0XlH6rn1U5h9e(: !Aڴ% )Ѐ S"+n+ڛWDD 9NY""Bp1L^ eE@6uej#sPzڽyPieEbVY9'X\hʊU_Vh+Gbqj>gڅpGe{} J Rj&Cj$yJ!Xq.)>'s É)A8P<`}]֭ᶟHTy:: 2tʓy_vŵ%NNoW8FV@Q5="QkuS\XE5<2B~y->{)XBLMۖ{6k(dѪ\ypY&G yag4i,J'$圝&U>#bx34Z [ړŨ9'z68MPBŵ&2mT)qIZIm (Aц+ ّkb>mSeij*@;IQlGJ 0#jD+ndG}xxU HR0@8:Ζ] $#<) c;u59N 4_ff$>t ̝@IZ8Wl~zLr,-> 0ed$3%%%aDvStHԝvDiSMkCNr~[׃k:F&p" GpQǨ@ׁ t"~jNqm  RP/ۍ]?Ӿ5&RxbN=>ȵm=GN U#}>vu 㶟iۓ&c2^GJSWsTL2^Zu-fi: (rB/ J I&>Z[_^34+ }CDK{Q$uoK3\Jd7aA8?婁["ru <$-RZFHG>\C_Z?]V%pnj8uV!I ©Qyo)qP8BJh}3?Mfl"kk<aQܥkXV1G?ч'ˌ~'JqZ0v=hO?xcիE" nt1VkaoYC2Kvt;*sAޔoǩYARؤc=#@v*?)sek_봍[k֜ש6RjT+x-RІA^HqϤ1 =iW31?˵]Y'{ >jq1]a!Ggx>{_+u*$ua##j1x*v#:Lz1Qً ;^rD4ԙ[5 F9Ž}]ڭc2(6aWL@0ȶp#i҉Bu4m)JDncr9 +_z n#Pܖ$u m go$wƈ;E='LiÓj{{he<ν=M(C}f~\!#Rf@1))[n#]_VH+_1uL6g:buB&ԊU(c0Nx븰 DmNjmT'RL҂H$p@fG H3U}A䗦:ƋOnH ^eU):4c ~ڑ%(W'h푨ȉyJN u ]>)DUϤԏ^`J+"fעĥH-eCjҡ Bp:1.KbxvBVd:D)J+CP.:'sd'q>c{G@A49^=I*2,f]h\#qE-@ą+6Q7QxLl2oCeO:x*^veY+z41|5y')*'c,Q8sY1Ʀu7DD 9)NY""Bp1L^ eE@6ucj#sPzڽyPAΜV ;BUddjو _/N\o@CSBKEDvܠ9Q]Ѕ:0lC&nY3OG CjYe+HZVJA`gOVZX{j;M1E%nIR9:(4QkQ_TM&$PA-dY@+(d;K@LRs!y#hu*c#5R22">lI"'u>=@QHgԎ@ q'-'уj{L}2rÇZ9F8y[gSI '!',%Wk8S5CgC_*MN`' @rKl!AU^FUĐV)[!=!dr-ֺu;Lz\?'fNWaGMŗaۓp0M11$,Oݤm>$hޡVSfzVFKR.Ԍ:$R-ܺ }B'^Z UQ":1ݥgj@%Ip*ʕ n5ѳ NY&%#*>uƑFۦ2B֬vߞ412@l<q5L{퀓>up<ΪcLY؈SmlGC8 q17-JȁU4)h(2T%Lk6hOVk@h'Ƣ&@'n]ȷ`sGtf [T8X3u-$6궞n8SDmu8mK'-8vD 9HNYuuBp1L^ eEgD@6j#sPzB&P8"HTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 58604 Last-Modified: Tue, 24 Mar 2015 10:11:50 GMT Connection: keep-alive ETag: "55113866-e4ec" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes D 9gNY""Bp1L^ eEE@6(5صl>XkD4sE;5>M_o̱Q\ \Os iUeBlZb܇?ֿ-+l DYEHu@#'Xu{O[.ۉK~ l6QOka{߻aTzF. ie-sEuڇҏK/ uޯ(Ų4DD 9NY""Bp1L^ eEF@6;j#sPzI$&P mN\Qu҇uFWʿ#!hc&>eYJY g8{a~qn;>~C+f5V[semXG?@QwwK˷cr˵_O-6nmC_Nk2n-_ ^ g:XRi+&qS׾vϳ{-bVqkmS@[fd<ٟVc.H-a#ZZe7cHeh-nm=߿z^]!V ]VXsw;sٕk]lg"@%&Ї2E.e\|vC}4G [}s۶7Iޚa/afp]-a`xŞ[vd>?5ަ[T徐'BT0&0ǂ]2q?YDQ2I[Ͳ.haTT}][v2*U殙xcIvc_[˩FedN ٩W!6sI>nx?[Lͣ 9kC|浣_g Ƿ۟)^M OU<)XZN5f?}$,tk72L.sIx]# K$'9ߝY_m *clEu `&b7~w5`t^ ꖜzn}N CwK@ɮ,/~;޺Zʭv@MDX:\oU4kjh鹍!M>`S]c+>n#hẗT3 =,ꙑU^LZ՗]$'?V8XD4ʿWs0z 5iw5X^ܬw}~6(?8Y]1hՏhsݾs?DL=xspw/Gè=tGB㾇xkp-'w5=yLhּI'5muS[MxԢl5~ś\nKOѬ'յݡXk[>$;vّ[ZY%Q_Z~!쉂ZH 9k^Ӿtʰ6^˛k'cmަ6Ƿ5۽[\!WW )KZ4Q%zYX {;?k|?5T‡>å>r hpCg;kaiRlh$5bu (DڼFV+qNaTUs]`pV.0p\잧}xRO\=:wװ.4WCM"kaetUMhȧԪ|M8} .x`-k߻-ĀMy=CslPYH?oѷ1~-(egJ"r< \>t.+x\a{:ḵg>T1u>NXW\ր-v I?I oӷw$ƫ0W98ϲ+7nIAT?/AmñN9qtD-ޣ.wUMUƀ ;V^L&hZ&ZqSHXvnɳ6MVv KۏCi4zyg鿝U:G×F5lggҫ~?"02lb:fNz6n$ƀc31\>o1NB@W˯ֻ #Ks]et2},zֵX~Iw}gvuuMX_ө [HV5e)pd4[ٟ8%#kl9ch4!98WYX+eo7~]p)vWg%_qm5fv ͻ-n>+X:mY2\}*[[ZH:X_.4t|:F>S92[b2:X˾ڞksO gwOjLXFZOm6sɈϙYא IDD 9NY""Bp1L^ eEH@69j#sPzR&Pˀ$'jZfLJrfu=}89ot2 H'jxvbɠ5@wc;?v+YK6[]61k6ӧc_H3Ep ]Qƣֽ:C<_6Sdkj8%.2H?E*%$;Ǚoήʀmdm:iMj?d|Dkʪm'Ҿ0Ͼ̲?Gͬ-~QtY}`Y?7/ѱ_k}mv㆒繤Yd`߲S#WZ||O{#/XZ)Pi Mq t{ŷF~ {n*tۭfK־C V^1#>kkcb0AͿNkz-$ ([]VLZA}%eu"wEon7rL~n#V]n{F a 985wU$=@~7jVͩ[DD 9:NY""Bp1L^ eE @6ubj#sPzڽyPiw /*N3 Riĕ0JJ6{wc;;r<@vt:I?~!yR2O#;Ror_>1)rβH=`._jyNJFscc= zZ7~UY^*+>-h4†gY)!N()Jm}#=,,DA*uO}$D=PAcEmr3̯a9: <}(H{Hu^M)jCr^N6ۨRy챐;9J=%~BOu5rXaeА|mMm=*ȱ|PöfSq*LBH $Op>N, dG>zlb|1]DD)9N|)Ʋħϩz/f1ǿ':[Z ԚpOK OCxJA^ANy-^S[9Hei} #ە'>w%"{G9VF}UA|JҳQGt'G̸>hQvWHJj.o#pNDʛar(2—.n%ٗd2dg'ܨjibk;9}٣⪜Yʉ՚6(^ћe@RBcΤ40T7F{hd05->cP7v08@a("}"`#]Hb Ǿ>Z:*2BʥmJ3#GrH%C%IRU1AՇ*+ϧ ,-h9so{be.zU fb;0Rv83]%N4TAVGp98㾱+Xgl6W['Q"{JOAqh ;*#o>?mJ|@~琥LjAYUV&_T2~86Y !@g`>Iy4e ,#\YjRznr눀* ,6VvkU@L.]Ep?mO[Y ty/4c 8@9p^MVJ)1{6"o:۸ɻ&:n65kRT$<+<v@W<DD 9_NY""Bp1L^ eE!@6uaj#sPz|ڽyP:ksY+Jck#NA!5ٟ!㾅229kJ?2>l؅*(lbK-(A=WON-.ž/F"::P50 ƣ uPI-?s xX=ZAĪ211uD $7n5S͚h&5_0RjeJ 42~!m@Kqu#agOs:p4YOS;]Vf2;rCQ)W5V=)-CzRJ岊Z#U;r!PfQ r䶎 Y}' S~5ӕ7'GdMH\M}diQT#A,ǀUILS? FփK%͡JJoyJAq:\l DֹM +-"WQd( +㷷:=`޴d,Uv\z{f+/!D)Bv0%#'Z"HA6Nr; $2HV/5 ,~%[WUjtvԨ ,R^[px;P=d9!:oJw3nt~dܬ],P|3TB H[g24V+~WyQ%m p?wU~eX>u֪ymF! [Ђ NN@me{P5e%[t"fUBTyt`C6"jܒˋQV#i?MT4au4>a1mVfWRK*a,5KTV7%%!N-y#iݔ}u f?ASȯ%:rRڤ`5b+A>WeM=UfJ%JH ݐ@?!/ֱ`̳x,OSfD>U#'>?80;ҦQys*sq#G?5:]NѸ0["ZkAa ũ)ChQG㒯= sKAޘX[|zmZmNӧͩVc;JrbKkhfDکG!ǩ&LW+2&1i!\J;hι(IJ-?w!#UjHpVBJuy' dY=Vf,fJ@H5ƫjQoǨ)ȏrJ7,I@\@8:!Drנ^DD 9zNY""Bp1L^ eE"@6u`j#sPzhڽyP$.Do:\n=ul$Vؔiqj_g_3=f*[0\k z y vXr9AtĕQ1XD_#/TKx[6;)*Mr[PPBpQmGGGw/~d_`[]Pi#?bC$NKd P^Om#hfH{̦ZĈHD_ tINZqqD7Ia52?[`~Ls=Mcfɐ3d O TIcw׎yBg`>Y=)itP2aJu9>܄G*g!d5fȲY_w5޲Tzzc)N7d-,)=P Y8,@uuay~;pF݋'w=;6$w) UYЬ>'m' 'rlw˸2 kƲ)X}u dpKBCG\RAء-Fff-*xoڽ~iuK1L))Khʔ ;BlQqNGb#oBw I 1[vE^kǪBcT,-RPCaXZ kZRuU*djLDD 9NY""Bp1L^ eE#@6u_j#sPzTڽyPīlUh= [%2\Hm)*VOa61%C{OM'2e5g]1q)% $)IQ񌃩VQye:U-[ldXn,%k嫹9JA8sUo%8JtFe ~ڥ)Ьnی.7/+ku#F|Q%->yxCIQ GĉT6Ԇה$8BWjEQ'K~[깡"n8MKLmԐ Qrڵ l|pgQ{T,wVO×NNe%h[-7'#ݜIA|fcج%6ow]6kn)U7)wIv8cJl{-u85szYF\6qIy)˪o.woJ3ˆ<j Yc>7gu t5JklП2tuN2~CWSwu=e"H(l 㾓dئ?i&2)x3 W*SLRyYt;,$V>N@ {z|LU.݁nnZ[9uspV!c`=A«Lrm>k0 –q羠p9"$,0i'Y{Lr5fT(->SڕoW׌0ƈv^CRLFZPYB̦C@@xqf,"Ս+Kȹݥ-" ~IqlFZV!A}ܻEMI?קz}Y4R[BTMܜN?2NRx2`bx?4`\n"U\a5q TCo)$ fB uث5j5ҔsHr [AzJԥJQ' @W,$UaSy+!̧vh4Xh'9V􌂕wOj5?2x]w%2vb=DD 9NY""Bp1L^ eEW@6o+j#sPćP hҙ`7D``ִ X*lG78C5yEz^x0H{ D| <:_ YU|)-Na;=ET]$=gea2UX 'GE?Cj} !#qБq1sĺ.t( ا%mF+S5, N*H,7Oak_{`uM0լD X,[gfQA%:TV! "!XA? ĉklU#n{`&LPV%#'<qYIUDOA_Ha~絈$yW }LYּy}JHh_,mĵpȊ1:账v -KSO,;p L[j,bP@%uL{.N Fz5"BH  n0&3 a 8'0ep7qVEAXJ60J' b%@#Cn -j)iij%xY7 f%Y"[ҊܾIZRS]a() feto:OMp1_;m}Om-ܜ@iwc&] `j/鏣5u>oSZ/t$1"6L:7$~09WFDD 9ތNY""Bp1L^ eEX@6o*j#sPćPq>TΪ9XF=q3o߬$NBY,%X17^i 3/g Gi'Jޒ%T{03<9bi\6*c8z<=ZcT'/̴j/o?_eSV!m}yYڼ`s F N3m@Z *L.ýnU >7\ˊ.d1!ZQ'mfŭizG* ׿Dv!!'JOMJB Ky:؃_y}K6? Sѽ&2:h|JvgTPYmq Ī+k=a O 9B El֐r-#*3J[‘h?kϏaզ`0՚V$WUWJX{Ϸ:TcY 9lz h*Xo ՇG^b ͷT`[i4 K!x}1,?ݰD"-~gDB,OVE:kfX3i]~eP 9i)$@L1In7 {LJxPk(ҋ[EXLo+ gR7Ż  B;떫l:?_o^6F} @kvi Uc+dsl2ZcwHRďQ۸@N*3ƻOux2ߤT?[ʙ>=l"<=9p˪H8 :'":SWYz{OT#bZm4 wE*ec'Ԫ)Sfy۩/. wyf PeW`y!,\WA52G/F(zm=7]ov.~\}ȎR@6'zg5i*]:̿|M$T >caf0PZŏA>~esLҾre֐":ɶ@b$W)fPO'ɳ"P./I1 {./4.:+SgK Ե31ԕ*A>NP03)Y;\S5lд`}Sc.DD 9NY""Bp1L^ eEY@6o)j#sPćPG /xsUI9xlp MA;i^VZC°7bB}'=7%r zM2nZ`CENy" rbޅBԔFVkT++&1m;>~?VEXN:/3$'=0Pu=# +i$k7 b}BLHY4ɱ2nݷ[\GQTd9̲e:3Xػ)nnYaBMGt}DdUgɲʤy\ToS{(])}1|YrDMtЂr,$2G"SIJzvސpQ晞l/,O8/$_cIkTrN%wi2 }>[}1#3)zritU0Bͯ*8q\Qh)5~A9P iwm9F3/a^Y31Q/5Ba)H4Ǒ3NwLǎq#.o2OQҶdV{xB )3:Ņc)imYiiYTvH<861G)2E#L Y<Qf[-LK<)jhɽ`O7>>X:yN9fei湄IOC@c $XM,)aUfs ꆕ_EmGT[SKO8q1($>vGК&Jfj0o KQh옧6idۤ Ԁl< ߂'w~EE@o0$߸E3M.ތ՚RmX?\.M泳Y;Fvtr/{[o;^Ѯٜ ,=(|SzOE4Œ:ma(FҳIReKKao/s5e~a{8 Tp׸ַ.&(*kkUӬة9C@i"HTDA:#lh:9\Llvr7;omOYB6y_tזeѲ>wimljycJǸs"ձ;H{7.XԾ Ke_Đ ݍ'?%EV?{>vQsJ63:SOw/~쵍49' 6 vl,7i9mmGLJhNUwIuznFΧ[zYl>rv ;\G|.6 * 몪?T[;?(C}U8C;cv~VoG+#ZOMXd9{ C8.tⷮߙlϻe NV-mKm6beWeM{p?3ٵ^h:a}=FIdwۿzR#N&ON45_Z?:Pz#AL\&G}g2|ikgC*TΏe;g}kқ1.5;k-eVX?%Od2XȏvIq%"'h~gi~O=_nWS,OWl1ǿ 'Y/k,e/\}8H>sSh-v7vqܟl:Sd]=< ʵkn89kw-,WO[:S/u#)uMc쬛iY_o(h$ג>m7۶L3_L 'fhѬgc]㵮[m'f36lᘬgp8 2/>{Zȇluޗj%t6ї),aޣm{Y1AewEɦk뭖7!kU7@ퟤWq[k~AѵXttYu21qK}ćUDoe[X`mm-yw)/ء`sEEǒC=7'w bPm]mЏPclezafuۃ 4!~gujp>EDD 9ύNY""Bp1L^ eEJ@67j#sPz\&Px}O.ﵞ?cMHZ13WGi~Q qՐ:65jU^.#p{XݵβlxG-du-qlL긷SjqO8uM˧V@5gU_O*$fr<=~_<6_-}E5n沃3a_{vZ]s?~be:beoi~n~L]q:Lߵ0i#T^Gpb~Octt_pk;˚`70ckW:vM]c kmmj{[ˮ3_rjQWFW: w=W:W]1{_dNuص>e阏#5 uu6=OUW~IR poJW${/x{XǖUmlV?ﳋ2Ln-kr,k&>k?߮=N,[n6>O?j9x:6+NfM7uv;oz:G]9YoLU{ wc~}~^i긎&Kid6ꩱCmnO˽DjIL(2ڷ[ֱEdK'f3F3[``do^j$B=vV/w_Sz;$e=w8Xz`]e,~okYWBde7@]nְe̫f-qRhAvFU%]-$Ӿu> 1\V`9.-=k&̞r)eՕ0ms->ʟ]K@g^{ilhԤI",[ OM"Zzd;.מ1Yį2YkD9i~DD 9NY""Bp1L^ eEK@66j#sPza&P$X=2氻cK省ow4]gZs:Nv%WeeWafñs1YQ W-v>`O%b>,!&8*⌥8s^ǖm_Ks;Z=nmWrv?Q jߢ/K\Q t17AoKhego&Jȳ(1a+d8g8?ZY뢽ּ/%.O夸W No/oM_o>{2ЎFZ]Ci~g;hHǂw^^@Y:z(D;z}NvOem};: 's,܇J*+k}ntV`ܬ=V;oͷ~l[/o)lf]4ϴCp}On~D˙겿ѧ-/scmyv -:qU̻l+}:^*mSmWzw_ru}x6Uf[]F{C7}tt)Qn1O]L&͞ouOe $z='QGӏPȿfT)#3(U][W:G w =5>æᾁ{prUmsǩz{ߧrVk:5Y̢+cH~5m_[ruOQ+ƏK__^YqXK7on( =o 1mgͣVbpf-1ᢷ2r?GחUW{?}ha]fzm~b\z5zmTѝu81h,*z6aщ{]Miz԰Z>?ý6P}:1f^F 1-.~3Sk]}YrXcGKfչNUڶ*Yg"_+n&2p1~Ɉk k'۴m1PmN:FOڳgmYg}: \[c.xiН#Oo\[թv`nSK=k}ޟRMdUQd߲1$ׯ[m'u^-pyo:DD 91NY""Bp1L^ eEL@65j#sPzf&P&EmoꅗYc8MpC,9$_1/;7>iZ@զG1!YgOmt K,q[;{?;ճ~v[" #ܭ`;YeUA6u谶gzR]?Y}uSMW92zMelߨ˨ce/◱\mnk?zOWeUU3( Eǰ~NmYͦVr?"lx.m6zK*oر:Gɫ<`dۖm{jmUN&ͳ{6Z.V/]Df\ܖS cn[/v9հ^Y]PBf_NE^*fS_Kq6~?VLyW"Νu5_v;{ou~yO5~g謟[ g۱+=`9odXTs=**eO#H&ͼ^Nr-eVUmcZ?ֵ>^lWV3n2E~..MQǻӍjv GT}>>_fWU-kP붻3̶RrY?oQ{j=JHˣ :}l镴1,n -wPJuv*ߴ:c2ܟ;˽K+Z{t:5 "0w/DSXnk2oٟgpD_Y.=._f=846r1tU~^?E~V%R[CS4;acky k'{,B'S蹰]U,p|;n^zHfeXYOP%9Um=:Zs_󸾍w]폂z]>1*w)ۜ5ߵz۾__ͱ'Rỉ1R,ja.ƤMw$<@'OvߤODwI;$*-^Photoshop 3.08BIM%8BIM:{ printOutputClrSenumClrSRGBCInteenumInteClrmMpBlbool printerNameTEXT8BIMDD 9fNY""Bp1L^ eE$@6u^j#sPz@ڽyP9*Stz+i4 c$j pڅ%S).HK#$3< YAA{*&=>-g\]!Ȯ@e P'8Ɯ*.7QVgu ́Xu%:CC@@8#jC@%q=5L;7襖o{,_ )K)m`qy v/v+ElnR6U#HܣTs3ITZg`F+ܾ MժMϺm|8BϹݒ1ٮgM{P̠su} jTH5e_rըbLQJttWp$`'O4+nvH:KTGܫ /!m.0-%gr@}2CvAy#z*Crنm+ZFB(?PZf֙Xb&=Y8Rꖨ*r%5g THYN HN }έNLLtE=ZYrTK YomqNр8Hn|<3iB:+LMQV=a~%N+(gҗjD1+^Sks\F!ban>mZ Q!YW6){˹AU&ڂV6G087)j;f$#N1gܝ@# cKpe֠\X+D36=[FNH$^fӽ7c:_ Y.h0?E|7LTSuD%65T0BP'/j:y. 8c&)4Q[W3*9,<@8#q$QfQ&,DaNǩSHRkan԰ ZG+: SU#܊JzV6A`JwI-~Řw>v_YEL[rie)eQi\'<I ua4VRy ;Qǽ/tϣz;bRݍ|B irL*nAh`'r;|! >7[p;a7^< vzL'Q7{a"~Y@ I?) fR[c_<߈H**%ɣwYdCH7t9Ǵ4ǜ%B 7"ߖmL*biVBG!ϔ%E~_Q#vTbM؀Ӿ DD 9ێNY""Bp1L^ eEM@64j#sPzk&P;printOutputOptionsCptnboolClbrboolRgsMboolCrnCboolCntCboolLblsboolNgtvboolEmlDboolIntrboolBckgObjcRGBCRd doub@oGrn doub@oBl doub@oBrdTUntF#RltBld UntF#RltRsltUntF#Pxl@R vectorDataboolPgPsenumPgPsPgPCScl UntF#Prc@Y8BIMHH8BIM&?8BIM x8BIM8BIM 8BIM' 8BIMH/fflff/ff2Z5-8BIMp8BIM 8BIM8BIM0 8BIM- 8BIM@@8BIM8BIM?g*h-1nullboundsObjcRct1Top longLeftlongBtomlongRghtlongslicesVlLsObjcslicesliceIDlonggroupIDlongoriginenum ESliceOrigin autoGeneratedTypeenum ESliceTypeID\ 9NY<<Bp1L^ eE(@6њj#sP%nEIP+\ 9+NYuuBp1L^ eEg@6Zj#sP%nEIPH(HTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 27772 Last-Modified: Sat, 28 Dec 2013 08:15:36 GMT Connection: keep-alive ETag: "52be88a8-6c7c" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes X 9NY66L^ eBp1E(Q@sj#Pڽyz,P~XX 9NY66L^ eBp1E(Q@sj#Pڽyz,P~XX 9NY66L^ eBp1E(Q@sj#PuP>(XX 9NY66L^ eBp1E(Q@sj#PuP>(XD 9PNY""Bp1L^ eE@6̬j#sP&EIPTFJFIFC  !"$"$CB!1A"Qaq2#B$Rbr3%CDS9!1AQaq"2#BRb$3Cr ?hS@qrߵl;pG;٬ՕӅ34*1,Ot2@QVn͕6y/jH"A$V9 :WH]]K /oiIF<uxvʮin<̰ |s?tϏVe={ȩȟ<[?W"IoUWw}eJZd9<#9<; ZQ|JRIdh{67-[b]o\4pI+& թ =[KtdRTG컗8O zVX]ѪW;ێO4ȰzyI s~UZ+,l$yί6HkJmػ.0~³sNHLj 4xyC2+EҡO՗d?a99qBV73tUL\pc+@Sjx>p5+EeME׹smd=d! :HKH8chR TC[v۱Y ߮k_X;U!;0z4QsDDD 9NY""Bp1L^ eE@6̫j#sP+EIPr.zUuKᢵ]n7**=,ILJ9dʶ㣮$^:?_ﱽh]|hUOa:^9~1:t\7ZZ iy`5-ddG>='r4 z))j6|Pgwj'hj)bkJ iAVUWjHV,uFF_mf/,qv-VAtm}KSkZh.4qU+])4EJQB0\#aQ4Y]ۮY/m'餔M >cЂ9fZ']kg4rQ@-S%b$Ly*w@FR+1iנ]v&gIo)Z}Δ! Ga@n- 2Z"85YMJ+3##'Vor- #w$HdjIibXrxִQAkPUU ԉ9kTx*˥}ʞ8ivŚMP]}\c3PR#ض}҂XlpVh4B(T4VU_vg 𳆥:h}ZpeK2=$Qmȫx 7,yMrPKRJ!pXNյ{ed턂ҕ !WY**r@ Pv(:[B1E]נZ-L\G"G$n Ȕ`8ƺK%DrJPPYE%hT\TӭZNBjI̎IbIWM !EZ* uA+T'khi)z _'\i)8{sPJP,fB%;MiM%Vv,bF#te%d8TΥRʥJ*tdHHy V"-x9Υ\֏Ll }MTBhHV-(}\SΪe )F Gnq[ RNi+)d8z9xKR_>]R%du$5"E?XJC E*~UEiHA+90Τ-R[eы@D^ƱE̱I D|/4vܳٚ Ɔj 8x5,ik6[ eU[bOvFdU)֋Vg%6YNWO[DX 9NY66L^ eBp1E(Q@sj#PEI0P XX 9NY66L^ eBp1E(Q@sj#PEI0P XD 9nNY""Bp1L^ eE@6̪j#sP0EIPq2 ׋] wZX42~3ם&96m<[SREOM 9lcмO$Ȁ]Z)MOrYnt:9^g8"|JA>3ֻ][ܥJ7Y`5/oǰJ:(6-" Z8иE\ Me\%"F;*;N5֎VBCv|h Pt@UH>pAՔ/$k_PZaF "? {նj{竨JzK p' }~Pl.֪el #Zy&fȏ>qۅղZ\>𬧤 7 @\1enIDv5ţCǤ7Wci rVX1E jj%X%y$"/_X6]gi)# rFA3*:\nUG}H)գR\L3糡9urX꥞QWRf %B=OCԁCd3TBN-]%5$*υd37_szR.Kl堔˖A/D1՚U= k.U/U]U5T(4ZFC'4As*8i@;|N*_TDU]{kNSJwAaS34+5D.QH(@BﰡGG@b K7%,Y>r{ҡky?Y:E* &FO >|f?}u|C9H+"#X۝(=:S(|WjBuu |Bo˵($Zz6aE}ܑlz JI:CE cy[Vo}!V*`NMo yn*9Y <@8Jr9Zoj.UsBʗ @Cj5[K5ҕ玚x0 XTG/^c3%5z|aqVQCO#qWl(?׿'I[~MBԢWKI;rx'RBs8M1M!v ΒW&@A#r>ukFKjR]19RdTS?r1@ n{ mZmBK*/51y \zƒe &|:+%U :4RR >4N!27JrbGJH j4R9@ j4P2% MZ\d#Hey:1DO ݾrm$3r W9`{[M 3%؄8n_u@tP!ABuj'R7/ lPF b3E qʧ$A\w:#{*ʧ!jp|M)Fz0=˿mRѢs?P`k Xbbܲ׀ޫ?!T_:u$e VNIHFt Ie9<#g x}%ܱ-T^H0wn1MkKco.L5!p<|g57 kO<*c'ۜHD^*aD\ 9NY<<Bp1L^ eE(;@62j#sPV1P-\ 9;NYuuBp1L^ eEg<@6j#sPV1PYHTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 26023 Last-Modified: Sun, 23 Oct 2011 15:59:38 GMT Connection: keep-alive ETag: "4ea439ea-65a7" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes D 9_NY""Bp1L^ eE=@6Dj#sPV2PIJFIFHHC     C    C!1"AQa2q#BR $3brC%T1!1AQ"aq2BR# ?ڲ3XBɶʎb!(':B_ . {` j oO*KuI d/?碢.m#VؑvcJp5f@xd9A:gW,x9A=?Ƃ[zK`jUW(%22 θ׏8T#x"}RELS Drbp)\HZR':EO>^G&]5mVo w :g"yMlFҗ021Maw?엟h8~ԞdVPޕjXft.3+he66pgVÎXRq9y₄}#*[PC JRA>)E$9(eyߊzM]ڻ^Efݔ}%ȧƊ[ǘyE(NԠ9sOsOKZ u[^UIũn@&( yՓOw=<Ŀy6 U߶ԩ"eZoKF{ীxg撊Sr,=zT]VK/irbSR*Q<}3̥x~yگ83L?EDD 9}NY""Bp1L^ eE>@6Cj#sPV7PB0I72)SA. ے1;wڜǕdrU<^4qaSOmܿ7~qlZ(+RF2[ZGkr)m<@JF3LGݩU(Wĵ2DDj 'V+>. >Ftr߬ cYE (9^w ymErj%ʃ6(?9JfLm;X;`a# >Dtl# a_Ks"Nie')% 8?aQB㐳شЌbMB{Bb2Z[dd8>:u--cKiHy)POVE}JBOư҃YJ)Mp0=lȈ#FVOg@`r[+m2 ;÷:7FIn/rZԀYܥE'wZ9-2P p 9{2УTml6p@Nl#*^ d,!RAx?3lr]2U%!(.-iN~q3t6  KhSyG?n4D5  cB)TdM$v֠`Ӿsf;eN%)O%D :[`W-# BJ@Z"9M܅is{jk"oEQVƽb 3%v q{ bGaHN{cZQ/[䥴 iJf [`{ kiVy:#1حꕽjOsFF@26CmRX_Yrs:*ͳ12F5 yFS6N1+IHN-YA_=nDD 9ǥNY""Bp1L^ eE?@6Bj#sPV<P3*pD)Bm@HmPS߂{h)g[jeP*Ҕ|ʆye 9u[To.:!`%I},~=@ްH;iyQ \E69 "A)إ)8 NFBJ kYΈcTe?huIZCnRT䌤e99Y-XNCW準L547v)IۿA?8ST4FZ)e)K%$`|WFqb^D$ {F@ O~e20(Y9Z8<kP[ 9 #ץm6YG#}l^Z>`e$Є(uB[n_&QHBv"@{m!9'춅m%%H#)-GkXO+w%M4f o# )sIכdZOKila,=+VjR'\aN'S+o𨃅*Աdw>ߑ:jވ$SRZIdSy[(ү|gTGR R%WLFbK,i|t$w$NH]zᥘW\ГFi- (l E&LQ/j4BJhEdV{|} E7s\'VZm9!YVVO%$ct8V+s.UP5-%iA'n??m2Ja yl|MIPV?=jv˛Z.G5JheU7x?jQgg&Uj-LTt)>J$PB y^S{sAwt ԾH4Kk!%d$29>La@J>a !.7ʱUn]FHv5#nP g8}:TkgڝFe@QGǎRpBpTBA /&kz?!E5^¾uzmtz"3 jnpmM2I)J'?}t&l__DD 9NY""Bp1L^ eE@@6Aj#sPVAPhc4]F 6iN㠩n`gj@רsNڷS{QUb.;(6K|A@2r!ly~xX}NĢ&%y -'֌oqѦ#C6ۍGm'J@=D- CiN 8P䃎Gq΃Z!ʘBMcT7rs|iCD q&} Y){1ebae~YRVH Pm<4lST* )jO}#ehu%)QxoZzwm`vs*xWW.-'Jڴdw;gYsJ$)X@I qǷl1 3ğP1ƞr-j .)օ pqFɴNm(l88uJsrAr7+N j5KEEH ZZ'krHϧ֠YSVV[I8**Sj9'hѬUf%}|bBmI?ܝjtTLOSMvTR G wZ`1|ܶJ$:}kp}Hq6K ;=[3#ޠH`iFU1{pp~֤/GPZm06R; X*4DD 9NY""Bp1L^ eE@6̨j#sP:]EIP,,Ļ`:P;ZicPv–J˭T؍͂s8h z:Bm#qo8=%.GY=FfA>C $籅 < iG+A j%17`0ӌ$}*sLdgbXc#֔WD-wU=J+Q|CM}_F==2S>"VXUKͮ=5U˕B`pG#OYS$51q4N?*1Zw{e5Mf55\|gIZSTm]_MOKP'`y H@qa@ (/q/A,368 <0$ZD'_O8ܠZT"}e>JqN,F+KI/CVuCm6M5iO'sn}^HfYeBpr5w.AEDD 9;NY""Bp1L^ eE@6̧j#sP?IEIPS[_tk+x=_8=ꖻb3:֗vӱR +Qo:A㟑fFK3" $ۮulQf E籒}i,KKBV5VNn;Oi<+T^Pks@4YRrӣaj93*ETu5}_[?@ @1ckjHZRwvh *J;0Ɖ.\o ձ^=htT$}-W@ϼ&YS>X/iZ$ 3wrFG#5vNѦgmῤUYz$F8Re?xs,+ GZ)v q*e.^_& pOU]ȅ-"q}`!9-$p) L0ښA=CꧢheN| xz얃%96BLGZm:!XcƮ惲r^u>Bs^u}E:STQRH s?)wQ#-KH@D^t,yQIcY'Orٌe=7u Ĩ,!VY.ZH|cҏ>V<Ŕû>PTS|ǜ?q#7+~孷n:瞦ļX΄CEfCyiHw1:э+kEq)V5Uh=dP?KWX't1s fyrSTPėH+YCF~9/nO,ߥѽrM I)C qc{O )]&>W=t^רBG32On- c5u3b]Cu6{5"1bom8! _ԇ 퓒?mI7zӒ{ |P,M֩e8c b0k`Qa^νoeM {"UO>4(fl'dAK!P.8NY!rEIn_ļ&Z4 S+?[) l)-;Me0ՠ0(a-j9 ,%CXV05*:`=|gQtG}r׸nt5|S|c2FFƪuCfkޞf-#( Z1ZǬ_hjXn0 8F?q?m 5aK3C#C90| xQT1{{ cx{!+\c9:xv3GG<7v\MI4sKc|aִ*vkTXxh3p3c8ԅ%!Ce@=Ί)BJ+7/EH p*N7*O 8 \׃kw}6xĐ[qy⻗I5tEc̃B{ưd:kn,~]c!-}5l,1בcga5/?oJ{bns-eFRd5aLM{i_\Av->_Uۥ#!uڪT1CWt5[^֞4bSːq׌cK>M潚k'X? F2 aIA oTx)b J?}_GYK mKBt4I<h%K#BhD˴Tjk(+j \ki7rQTf^OMQ z W?X?An g3XPPDD 9NY""Bp1L^ eE@6̥j#sPI!EIPޭ95ʲ-K#Ъ5b}lQzЙ?mS'e%kylPT[JʪTPFAH¸rzO;#o rCoB=p{{3ϟβp_:/7nx η`ktӿ%cQ"' m0^cI(? mjJ#!8RIus|YO6ZہnQq!I_w`Lv[H!eĊgWqΊd T4cKuL̼a|}va)iWlmN\SUJ>899zdKF8,ϻ'Sv[L".â> }R\3IZN٩NUwTYy{!CS g0A>CX٤ޫi) ,eX:>{ǍiA#KH:V4؆OZK N$2S(#DJ9執Umۗ<60OYZDo"s|2͞G9']LSA$4Nj2,p;sj͚y/j館B4#xRЧwt(*K,[S!WR *UyT2LrrmLvy_ דrK^kֱޗ.p$hP+TOX^? Y-Ac봯[~W)daFxnU<<7ZwwJzZ*+wD}y+!d;t5̏s@ѕ͍f۪zSqVTC*W7A EejTtG$/#\Fq_#i6.nZ)t[*CM!aLrP( ;1 K" yiQQ.L J7(H|'˻=eCMz=YXs!dX k$n{]UkjJY*Y!sr}j} QnCiʳl1c{A,Su.sթ((SzrN i_6C? ,f"zYLCHm Ԑ=џjJRrKl'LVi)r6Jdkzꅅ*]!2IRe)%I?.PkgF(}=6(R;s~馭lv'pIVp;k]HHgRozt+qJ[j,ztt+oI:CUԘ!y4;~;F l8Z]ܦ%1ɱ[Iă>PSyCqYnK@a/锬#5F-f_rY`iwNo%㹷偀ҡiQ`UJ8:=ǎ;c~A[t:sӺ>OT?;Lԕ)%cP*imҊ8t=UlBrBd) N9v8:ɰKc[Yi-Nrw(9?.l^1 hӊiy̦wĜ y?3,K^⴪6Li_ܜ''qQ 3 Gtjkƀh%LFB=}?d>SۍGS]#1TFVПuIduOii:R)9ޜk^m]E !$`+wrp9GΞ̑%Im1Tʜsj[$)ua'4 h0$ RT#,9*fWLd%Ρ-HQ.:0}9V98±c*4I/%(y1PTGqJvVM֪ϺkuD(ڎҐI$dRB]bmKrêHO* s~<:2O䥟K.Vd'/udgXvUQn." lߖB|@V ǟ4ױ؛ _S^q<N]ro?6L%JP+T:g4U4{oA /?[ mShTp}HTDe).ߞxaū\@arKHFXeJ9} p ΏFNcv֡-ԦSl)>ҐJ<PjT0-d8FTOv:eՊ'I,hG)nH 6~wzsP>7yujOC.IJRAO$04<&KOδWmTXq*Ji!J~<w%e8RkC$ixȩ>Nk2<+/DD 9gNY""Bp1L^ eEC@6>j#sPVPMPAz26)@$ގpcSv0:mlʵkj2\(HOqlUvZ_hL1>]z[-EVx) (LxtMFATǤSu-S)a/J !)V8< q ׉̟Z<%-z=5z*.rքR(JFsïs$Q`R}WPu (ME~jJRW5ĕ+gh}z[Z[[̷+ CZw Š}T=2@&;)h,D%`v Tt4鱜 BY[[Υ`wg:՜e @unJ}~VtbTY=H0*KRN1m nFцYy + ~&Paq,XN0`r6#``f)J֥#A=IE*"qT}?{*,bSRCK Bs@ӡ$ӑަn )jNԟy9ƍηEdЦ:).C,((>0xqSG֭W9d}0OP;Ri/:+#,՝By:an]%ZwjqW% HʼeM$TSNF ȹ$rOx+m!URb홅ʩK ??q;hUE!+xRlPxu_{8iVIsd)vNMn;m2$MDGH%!<U (?vrDž/_3O^M>w:˖>jJ[NJxv.ΘVjI{S?PʷT=Đ3lEdV*(qCJ)pnBp8=c.V *+K$9'DqpgԬb1[`ʒ㠸Hl(H)8<5 򸲋[B]>n9 9v9ZX<5y0Zh kҨg2$R^q JA<5ۃ,(qm$WJrs멲fqq"hI!*wYWSm3cYdzaDp)M-K9@J֤zOjdzc Md4uaJ'xi4-TH~RBH + R3Ƨ(FZea)C24j}:9$+i?tIfOPmIviWϺ϶Jyq/io*IiU_KxMƎ o56 ЉhyʜJ~:[=.Mv[7mN)6p(F@3λq&pfQzD*icgwORYvGB$Umfg'd ezAqIj: @29aI/km䩽qE* pB?]?nps}VHmVR023M"R?S Se7p1 z)WJ̆rA*2 wI9t_>R\)fpD\ 9 NY<<Bp1L^ eE(@6j#sPI{-ȈP\ 9fNYuuBp1L^ eEg@6j#sPI{-ȈPDHTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 22647 Last-Modified: Wed, 17 Sep 2014 14:52:57 GMT Connection: keep-alive ETag: "5419a049-5877" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes D 9NY""Bp1L^ eE@6j#sPI|lȈPJFIFC  !"$"$C Q  !1AQ"a#2qB3Rr $%4bCfsv(578STu5!1A"Qa2q#3B ?=RTδ%Ќ]2AtG8sHz+~ւ,$7ƹ"\(ǙO}2(A(p(u\=Z/ܬbYgj$8j_EO0^r̪zPn׋,cZi0 z=5:d}})](0-:{?|1iƹCV貴 xcR:T/\_C~ط}z㿞A] ݜ1Cv G lEgZ= @ORpVIJI,h_ +y{k umeb#]~l㗗9LzR&M4;eh$S VI}`kNJz QTX2sy-%L:vy>} \p/4֮͑gAdQrN<-+ejMm֓] d/qyVڭU4IV%VnP v,zy~$hi>k52bSJi{u#uW-mI/%,w^_>CU >yھG7٨FMUۨP?,hXmcKNMAױW% mqx&PD%򜽺zj/Sm4߲~Hm]m[V6 eS^$jҝqI7Ku#-憞dVV\=9DX 9nNY66L^ eBp1E(Q@sj#PVZ%PXX 9NY66L^ eBp1E(Q@sj#PVZ%PXD 9NY""Bp1L^ eE@6j#sPIXȈPEXDr|+Cl";b˹jmhyi*)|{=Q ;DR?%ogN溿v;M-ͨ`1P TKcF4e&tFO4OֿaIpR∩dip1Pq͟}*2Sjv{' DV#@nyyͥKs.jii2suyj疣%WPFi#q AιeNLsԟM2=:J( TSRX!s c-j驪)g8qPѺ`ySb:,^8 5kiQL|PÓzzzE|ŗ{u6xݍ{NN\9VT.~Dԩ b𽚿5TWbGΑXcnF-N~WG]ft"^}#W*%IoLKeo>?Fۢ,~\Om,<>03x8\c sIǩC|zb>ĕ>cNTV˭΢E3К>YQ% jZ2uz<ڌ$qھl;FlES#N}bGH#R7OUZ_ ̧ͧw㚻׸9^¢hA9OUӧ|,.o3kn92>nW $D;aiz,>MWm)6HiF J9pYYT.}!=u3۝\eYX9MP7v7;]f `DP~)Rak|ZʤWd]^)Q娓RG- 8 MG溶iӳ˭jQ ET4qF@u\윓E'7eɤq~UWV^.*!ys>?xֿaiteI*M$z8f$$e2zSI[] )WMWvU[RrvƜB{Rt#EXp*Dn 6vԐ0.5%DD 9oNY""Bp1L^ eE@6j#sPIDȈPcԷd%C@B##*p\3*KxS6-T*oԦc^drK?DG=5%Bgʲ- IaY3I#v%FNvλݦ1ncA]ܛs⍷sA5}z8ᄺIE8pA7u>TV*)xJYIԹ ǂ;^W6toF>\Oڃ6ٿ8zaR)Ð3=5-rHo]o5lsVADSxŤC@};j l~prq7ψ1IzI]TP[8G` w j+FȎJR'0Sٹ$q6YFWm~#kǵ /}]fK<<$P >Gu8v,1;/N^,|zས|sZ+T6dܧvxvZ5  *u#.Aq!Kįh`NHM-8k c%83-IxPB*)ٹ!æ|z6Ώr骖kqMLkMdԷg%G+:]GZG(:T=vv\);DJNF#;(fkm-a%6x)bvF6pY!d6D=@e1$::Co}mکpSiq$`U220\vԐG&_?bS퍿z2ġ21muIzI'AZ{=6De[bY \6uxI\XCwΤ0Ԝs&F}5YRA㐝s8k8Pxōt$:/KC$s}ƫ)mA1cy'OpPT-P?u$r  @ayb-A,S“C*Kdt9 ::(p|zko!,"(3v(6ݺ3FMdpyv礖ۣK2ww`V qQ/@,HH,FXd9 i6M·TOUF#NXB @8-?miB,G:l!{03FEm{Ů,v{MڝsY}iüQv#R=U +v=VhTA]K&Uc14RđB5k*?MFgZ9q~G:˖OHEǟ#|.RkHjjkt+DD 92NY""Bp1L^ eEE@6@ [<`N 8 (t:=IݚL)A#v:59*=- YSn΢(2R%p >sմdȻWLfm6J^ Byjө@kKQܣsεV,mVzHmoj~#hRjv[|1:K&ɣT[2ސdӇG9I;;kbKbO)jנm0!6~BTEu7=O'jY1Dŗ>U[2injJ_@HlzI q uE;\Kj(G?X?2+Pm<>7(gퟝ; EGjѢԜ )Д)g8h8I鑣čOse9)r郎c '$c'ФkdRjFvUޏP0-YaR)I$(g INuV%zq!ɌEdP]ب.r>m6 oh졧:it6^%f&dm͸YZkn{%_n ::`7%9PܔiD- Kg~T#8ן7 So_ʊr +=^V{Ԙ.5QH3FnWPүϔ6i_?RǹPTwOI.DVcDIpan )RvGƦu+B y:Pĕ<yԨ%Ꚋ-))8)l(sl8%g7]z[OA['BiǠ?0YmO*l#$d>V+ӥ8 g)ƺ9`ַ:kDUrTu),n-@H$ƺTBSuBݹܺ]EɵU 7a?Բ|+|B2;MT*DD 9NY""Bp1L^ eE@6j#sPIȈP UPvQKU=TJ*l%V,47EJ9qHiMol i9l"RĤ;철sҋY+p4Ю˿7&e^ϳH !.N>嚒.4ch}]nTsi֡Ԓz|ƅњdW?a]?[8vJ|«1>Pqԩ{ڲBshJ G-LYYZ8+0RN;Ow Jxq1C~e$Az l.'#?h2l5*B"V,L[_Jc\GE=UF*"pв AMN/Ԃ.h^rçm&o (1,QP`q~MyKOK)X;ͷp1$[>X,2U"- L2zgmJ.2iڞ16^)q;T[Қ SF.yy綅Q(CrV١s;pכ7șP r\M ЏǗ$2[mkA⮧Z c4<J^`GALyĒ 2-Ahzti5@Np$@s?TȾHd> w}ʪnRO +XI\AǮrIp5pvmс Jch?/Fɨ"Xn)n*}X :3WŨR^ C4qۧHUCs'AucYSu#{D-0۩gHiRȸTPsa [旹Tଭ.ؠ#h|Y*tY :zcߔXp\Y-'"e땂ISlyrt9i} nEp[ hq̣Ӱ ^ rNmٳwPC,(Øş!Hʎ4m5 T\?in%X2s/`yA=]/ oCߝ-ˍUߩ-um:M<Հ$RCaˌWFN.- sSQ.q:UM/7Gu鮂ရLJ"v)$l$j.\J&:<{inTJU-@O?P?>&62<_5ziF.侚u*n]OQLӉBJWRGtєDD 9NY""Bp1L^ eE@6j#sPIȈP/;%Ẉ~rk"oI#F$hǗ?ƬUbXԣuv.|`%_ rzgN/Ip(^R-8yWg9UyIwRX2|-l̍:⦔!|(OA멊J-(Y*W JZs$Aa =ӶuLpM,R/[oi[,hUV{$Ig/r $zQ!Fѵ6jH^#-2S@A˟#iDbXp@냅zCӷ毹 R.1HP7w,tXG0BGm3$gl)9c*|VJr"kP*l C:L{DTZMHRD*sHqᏩ;m쎗[Bв Z9%sBW9Q h)"wI*T)$p>xNʺ'im[VbY ) \ՓnԊy}.Ƕ4Iz{5+ L3ΒkD!rG~5ͥ p7"M.?wYm;wΚi^4ѓ0Xv' t=GQ,|Fy;M[\).T$ٜ]_}Ji]Trg8'd%^8I7ە RGc$KEKU$dyT2B/yjrI8[/ܢ6~]Ku]m0@;G"$Xr4Si;SnZlk<[ਝ I#hא$<-q[TMDD 9ѭNY""Bp1L^ eE@6j#sPIȈP^LM>w#ސ ]tBRZwHp:rprTKA8\d?.V*^{\b l!HMHQ.WCE őKs% q:wQ_$nG;q\0 ?'LG~ jgP߭ps~}uh_%2W(w:XCkU;rIy mG$s ~ t'=J̗w۸vE-ҙbfUը*Ҧ99K2T2Fq߉dk;U3--(\αC㢏tys2>NjܗJj=p1X0Ǘ18>}}3•]ʲp-*U ut*2/J1sʟAS2] Kl[}1غD7 sE-2sRYI9eR R\&8iu7nI*<1=~Q Q@3MumM[H4i5<r ~Gj9b\29=# [brr;|9!z~:oKn(/n~ e{|qxJHK"O\M/SpK[g+5mmMQ,\7ڌ0S6ܓe;UMtJ[hc\ƢX<:JvJJ9GlNI!]>|6\*ޗ>{%۷i.a5:K-[f˕Nn6<;h`ە>+k4V^ fcON;jۯZ8XA}>z,+nz{I a@^H6aژ^(44]oаT[ھihEƾ/eczo-DMz>blY*H21G;;Ylx(yX|:r,ufWcڀ;TzX&GKEp7'ƛm_OoAP/(E/NєRBrC=ױ(SRaH4ߓ`sz5|ܒk-.ʸWRf. BOt,k[Q/J'LQ$j%>3wUM |K*`=u1|wUH֝|<=tʷ$Ms |n 6yzcyxO-¦Xѣ$#`Av=>ԄDD 9NY""Bp1L^ eE@6j#sPIȈPx[mN{.;ӡZn.mVv\$&[%:Rzij?/G<4/+ߒQ^w]MsTd9XEX=_=hz|/>?3ַZW땂G\mtk0DAi@%x{gTɷ$@NQWh Mv\RK|I*Į@U w'YK4$j7dKl6~ܨ* ᨠ_:e#=Q?{g:$T ԺseÎ&Ӎ,۪4š9rā"V0^E8p5C<7h:[ݣAx.{2u'`\|&ۑQ]]=dH6{t'EH_lsImot:GsZ[ dHЬ*AǗQ,qcbβ$z%}eݨS!;>]>Uئ?b%ӗ}xaUOv0S#FrptG GfrQR5ǽmq)⧸<-: NOZu 4U|?ԼE]#SEREXHʒ.9~A:uWhhf6咗W? ~V-YWb#\o#F)3z:j7̺)nqsukp<)䡨DP`ߠx}C,pZH%mTq*Rܠ03Y.-/GD7H͉»E5n ([ ZQaF;=k贒o/ jqu|})q^^檃 blqE9t'֤'cŅzW_2 ə{_nnrյQ:M d8,ę[G<5h($ZW@+W}'$bz.#jP&3O\:46Rnj{Em[BS+wFKc dyc?cjjOA-Wmx7ts(*DD 9NY""Bp1L^ eE@6j#sPIȈPc:#"A XM u[mUw{mP2y؃vʗ1 AY]gV-B$QB(nR(ϙZJ.O &iǩ343)N\qw:'bKmxfV,re9} tDJGjBIK)MK9S{Enyv r&_^aaA#La߰)JKduK4+yӟIݍ~m\ÝAg o7 dVUoO)g?I|FY Wog )(C͟ cV6ՐK-t,UsSZhy"^PqL8KܕF]Z\A"2x^J!rˇFz9v.c: t<[c&>攊0/|g'B/9mI?PLxIPz)%;t~Mǭ*I]fHj9|:RLE=HO8z#K 6*ثH,ZdaJ w'LO4l qCr2&Mxi:)%jҦ[+~.4'/1[JiX$rA{3TOy~'mxv+f_FB(z|9(c$.^픛KmJ£$N^f,gJy/Dܵ!+zOW{/fޭ56c2"K-CH:Ȍ5U$^h.mۢG\r )ep*~=:HVgA6,筞(41/6r~#XgQ~ݨΞIo6o$-Β'*DX 9CNY66L^ eBp1E(Q@sj#PȈIP XX 9VNY66L^ eBp1E(Q@sj#PȈIP XX 9NY66L^ eBp1E(Q@AsIP3BZPxXX 9CNY66L^ eBp1E(Q@AsIP3BZPxX 9O(OY^^RE0ҥ9lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9(OY^H$c1E:,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 | 9<)OY\\332,`&鏺kh&  小佛專機|h 9D)OYHH^2,E:+_h&  小佛專機hD 9SOY""Bp1L^ eE%@6u]j#sPz,ڽyPچ:g]$Q=J5Tɯn( ,")3P#KY#Qz(|C#2wL7eebK)녲RmP휃'LF<2rp?Ӈ:|%Kv2R)ˏ,4ۀ<~l;5ũ+^#AW9=]<ԙ ^~hFYD%t ~Re C$Á D!C+dwu4hMu5F9k%NN[P \5vz}kXо)t4 +%ܔFs'~C'R\T{bI:|NR+ 6,:AR䄖ck'ײN"䷏ؿsܫ=gRF:R!m(Oį!#۰*gںڛTJYj <zsyS=j(P\FeWʆd%1Z^S `'Ucf\uޕfN!+CpRM62p|I9$/2r|N5O?ib^Ǥ*d)82sq':϶Tx ր̞M2* 6[H* h߅$mJ g#K>Z|z5V.'M:7o3Z^ )\DaD$)R#b3$g)r%i=S:`J?QZ?MUڝnQN]FG2B`EGv #?.F mgWn]tNpϰd㮯ImJ59HO}[15[.Uvhç5%rA;F1Fh{=}.QB &&zRkq4)zW3Wd=A~~`1KqŸZXIڧBqq}rDbs^ ^ m'rU:!ĔHTƃuM%DqށXp֭zitn{,yF}9ZV {㸺؉:s]&#QYR!,JBR9 gu®z ,fƳ]:93XYOöNgvDİ=F1Fo x>$4) NywbP@?u-Н3B~B^Ld ;D19ϏxA>!5"K$oa,cDi ! X:V2BNd.# 8DD 9:aOY""Bp1L^ eE&@6u\j#sPzڽyP[2IOR\v5.~Sn9GP-d9 Lb2RVH DZҬ5 4mG+vܷ˖b(v:w\[Ki%%[% B6ԩCޣ<8x1~xUnen]l~%:&nLįoP0 #*K+.\}HjABA9ZP(qp,))W/koRt<ZKlof6Sm!46uKV?c>~bۓ lYՖꎱ%NP RG`{v稭؋e .LξfJ θaH!$'=3(Tu,n|Σ1nMG>Ent0< K[ԒN7c2G&SNviJΔկlD۷Df* B+u;IJ%9sȺ#2ՠQf5%0֥Dz RB%pF@I9;(j#bRqT^&X28R6y!@ʀZ1ݘoGaM+ \JX,0̧DsF;zƶb]r嶵:fSmY[4Pc8$r04զ.$/hJݖSV2 PSnv?i\Tj/w"d=gUnR aJS'#%Mj_RT]l"3R#T+ҥ ppBFNAD klQݟx[wdF*NfXp|RڕFŨ ܃{7Z}Ԫ)(v/TVdǖqs̭mҖ 8֯W4oMxB箺7ցg޳uhuuT"Rum߉vfJ#)q6ta Agg,.C+/>4Vx^K{U4u%_^yrOIh8NWiWP6J10Z!~udIRqj_%gv?:]tרv" "|Yb|7 џVun8!;!?#WĩgfX_ 0uFozAkL@P*'Ґ0Hש\ ]UuGnN/'u$(,IJ=V+9Y߉+Hl;ƅO~;62Ԑ6ꓻrT)1sq~ PmTZdR%SEV#8Gq[rnuj%W'?QvÑ#k{0iBD=IWq9mܨHL[x¶?h"SYmRD0wpi2?}GG=JLvBŎLܤzH%Y';R@u6J!(\{S>+.ʘ㒨,*8Hpܔcag6yȿ輸*]vHH>+H0F!?U {ԉI[m) ښ=FҦF%3W)1+r~|Հd:0м]ŧHrO=F,%Uځh'< *Oc5]%s!~Џt NH;|\R=?$y9זݏUeZuXuZihYmJO9H$wΠl;x̶W7G,- YVp>}yBv;18 _vq:ii[V5v˨(6P@O$q5a:{åMk+:R(1*y!缒]R%3K3>γ*Tƃ *C,a o*s4icK^ݣYiwP:wLQ cE'Y*NFэA-G=F>i̺\@ AAJx<`Ӹ*لf﫶1NTPR{pIk7v $}]2LqQEuMb2^@j׶M,?h2*OԎV[TUIZc~cW+& GQJIؖ4%8Kra))w`Ck 'GG:`~W*TLJA:6i1zL);(F8NQwD签BJ;u c]wGKku.):cf xˡ\q~m wAĨ$RxW_]mM-䥺n$)*Kl~eP~n3M]&eB WIQNh OA]5қi%Ey!CR fͽ$Zc-(1%C c~9B}'{\ڞKPLqkTW9’8g$S_H'uͻi4p*a)h;ܮy{Y@K˰Rn|VېiXaT2sܫ`v ErF-%lc.3$4IaG#~^IuUЕT{른VyTF@ᭊuxGJ4|a-b7Hj>e.jU2 f$X- (O+s25c+W)|EDZ5jAJPR@u0?H)':]gWF- z,(;<+=ZQ(5zO" t?Uyq3-`Ȏ['vbӡQj!4I.7QjBF{5n:}H=JCƛ KBx) <#hVU˰-bqfp=ml%Cxi!|(MsJiĮ3,)ӜP_agS>N "i;Gtm"Dv0&&vZsFÓԪD6·$i{0ٮ~'?]Y6HHϏ1HBAy!3'W;XDX 9bOY66L^ eBp1E(Q@sj#PڽyzPyXX 9>bOY66L^ eBp1E(Q@sj#PڽyzPyXD 9 OY""Bp1L^ eE)@6uYj#sPzڽyPb /N-VyS[*_R!oԇqc,g+n#(PG.gWĭAIVΊ]APZm҆ `5=XAJB3LCKl[.J%R?]yU վa'Pn3-*GT=\՞Cr.4g%(U}IH^Ҝ{u< CTx&c{ktHKqZv[ꔨ%4oPQ$g 2t+r) J]J%kKPow#'9TJד.a{?T!DKga00+9D/:=a3kcZSI Q@rsL@ny,JHW^+G">-e;v6hXQ#=A+ &$ZM5nΙKvmXQV18m}nL\jxA2+irn5ZU+øI԰ˑdZa-?s 8-VbqΪ~-huRqUu"ltV] ʔ2RIPOaі- <(s2S‡@f[ scxcW.N}YG! ,xή֖|p; !KdYֵH\br>*8+~DF@8$v:~;8R˵CG)EJ 3ړTΤcܤ}'z~[V2j!UzzF.bTnT[w9`5FՃsWVeC-jcǫ:T]q%YAW?m~n+9d/Iu'tyy%pÑ)6}K*> 5ĩ6yJO Iy'\0ŻQ $d䫝0m櫍7=ĸgr3ԁDN,cuN\g daI9 Ha* NzTIQOc=g#rTG qմt`A{ƶKuf[ X"4 NdI K>Q gN> ?i 5T^وj l! DD 9OY""Bp1L^ eE*@6uXj#sPzڽyP$h9ߎ=ƫ}5`1ݳ:$JfG2GmxIZaXݐ3/ Bɓ++%*˔=E!zJғ#kZi>ZՁeVfk:҄,(#8!GΡRZ2t۠ U.(>kQq=| R|ݿa[֫zІc%K8Qv Pyq?#PtP쯉OzfOm]b CCLZ0NM 1*N5ף/]mQT"6͞;98DZCDC~C W)ն"BFQj1k^˝PNZ"*W Km'b3U#մJ"3kkW|6rL6 ͤ$3tʔ&?ks'yϷF>lV5S:F~D$%` P\Skt2K1.*CTyI 󤹘Wľ>JUI꒣uGdS1م!zYY23R SWt:T/Iv%]&9cdx'o ѧǎˮ3 R=zSqc5(S`}p4A\z,P>#k34B4@>&{~ |Ko׷w qX-X̧vJPnTyS8u笈pܐ!P[R%)NxGSQ4] IGrANJH*Y\6Y)u-$j2~eUВnDVzTZt+yϖV¹+nN6$ hd;C7-Bj)\QH|c3Z5x*`R"ޡө/-zےT[Xa^x^QKąR+E)v2| )g ~UUfk#]#noVmɼGyDj{a5tz:Wxv .Ѫʑp}T *)I݃b>/F zi lg\7PyJRs et w?Seěu.ZujyOY*Ĝ5kv쮧B=ž-MS>%k%`'ng#==ld0sc J3Sj79e:}-CJJUe*fQ:֙UH1DD 9OY""Bp1L^ eE+@6uWj#sPzڽyPLih{VGnѕH` _vS#G1ZN\כ;*m*uS+ 9|BWTi O[(#smXPjy+tw'e5Noyc oPJHu+TZRk5KK d$>H6׸o QO^{WÒv϶X1[>Ui S DJF6tE];w$-*[nALGջ<뜟Nu9dv\"|H\pFq Irdl^QPR~3nU%,oJLfG. `S U嶵6ˈ=Rv~CQ< ^_'=S:VeN}%y@$U ,=js-BؓeU3WS/ȖS8#kB&Ԭiի}KܓQ (B\G!>(X7%?Rv H?C/#ZB*mvt~f1??w.!]KQw|钩qTIzj>^zeOZ[n2exu~?Xe6Kj)*d,q|LJ&3hRƬW^WٵXGʥE*-"Rʓ}v&YčqB\uLL)<(9qD X=p's]L%\_Q|h@{sߘIwhx LωqRՌn@H.,_4DEJhKiRWhu-'H$:^)D#uR۴j]jxscRGoR*#՟4}6*=OЈW(VMy*Q *Nޤ ))OP}Y"Q ׇ+sݗKUdAA 8AN2rtۨ`7-M)wC?AuV/%q%%i YR6[ N݂iF27EA㶬M 0)sձYFbrT%KZB{rR |D zN>ttd Ӛ;G?Mx>%] zrQibD)m) qEX8}#)~ي_;*`N(QfHKNpRdDD 9!OY""Bp1L^ eE,@6uVj#sPzڽyP ם2;)xqi['gJ2rɄζsݟ>"uEܰ*|;&@HY RSƺ _@c̟cQ=kFO&]H'6 Җ:JEs;㭽GSSqJJw'9NiYΎ4U5+%q[vfRXn}mOJ7"ܥx)gv{p8 tJ9N)K+8ZNT1uQ4jU Q>Gl0'MMנ-T$2\$6}Hcr~=ק@׈RωkzPoki06| iĎ=cߨz;d|E vCCYBZR8Dxݭ\7l"4ʆ Q%IJ3Ҽb'bHQZcVJRu,.yu>ڞDklUnrtr78?QL_IA ʸeG+(\w"o[Փ4pBTu{ܭ|ϔH[ߨO0һS^Uk&ǍbԠLq.ܗ]WL s:I!]ᵧ mwnRYcaj~cAlhL&P=UDTr6aJ>!=1bCzR a.Kj%)JqJt'~4#>|Qz^ˎSaaP>{{oQW?M(mq$%S*1!PISdu }^!##1Z_h',x@Fx^6=-( +K+آAakA>ڭqP.a@[%TI%J#; <O'\퉊[+N\sgl:wqٗCɠ;V6\@CImб"Y P.[z(3g%- V8=udeQ🉋ud:E]U=+##V{X_X >0oV'Y2'rJxY}@+Ϙ֯S,%OĎbui)CFjM< Z%OiѢߏpStECa/zRTʆ>@{q>VBlYv99ţ))>CLp YƴnѨW=BeRPV9oJuX'ŭBbg]Hgg+W eh%Mz 0h<1E>ӵ|>)8cGS:µxJbLCx@Hd2#C>YJ ԕBpX>&3˗R -WͰìSԌmo ` :ՏnXaSrψpM JKi7樐U jt!e;c!O.|Nիr.JZ RcC~Й:# 뚹wUB-(+z'GlHua^ T)k+TTXF.ŷ;VgT2n^zX]˲RͪbDD 9OY""Bp1L^ eE/@6uSj#sPzdڽyPfΨh4;0+ZS-#:J_;MU$-juXlPƣpTW-GaA)8ܸ;PkCkqw307pP5ڝ7ZL棣 ZK©%ȧr?.x^sq_PnhzeIO3y}-dm{nh@ZmK. ~-( `:pWj[t.x2 )ո)NEݻA {4JT9믷=>Ng'EmY‹#;=>]ƖYcЍP&%6jВp$ ҂OsZ$VsWDR>EE5Yx.\%EjZPp!eEI J r(c :K(R]_j:T')p>c!ZEJR (Ji ´_$JV/ۍvjBy3#QNb6˪q,D-j*+PQNF/ XD6!N-䄍RFIӨ$`\ɤܫ›."Ԓp; ܒ1t&(8$>BAc]WM(z2߇n% JJVF}]BUYĘ` XDĞNLǤ+Sd~+z:ȟh}4znQ. EB6Kb9Q;v{hy \KZeҷ,ޡo~3h*)%+Ɠ%* Y> `Z_QK1=h`ՖY3-KUVcGlo=n@8 ]/ RNs>#{Ro8H,NG~6(a[/!r0!MDD 9OY""Bp1L^ eE0@6uRj#sP{PڽyP/o"8IĄ= J-ū!سKGdaM>'UZg!\!أ-I&+~f԰1iا8ITUϚʇ|Ym62I؉:U+u>Yj+@ ߪ$%Gs-f~HI &U FA2v츐! GtN5O ߆B9(]$ܢ ,Dy-42}xԂhܻ> q#p"K qRTRY&葑򶑍J$*h@2=FM 吟ʏdjzS Nj6 |HT"R1#.3Q/ Iy^^έ+S6)sklKT?YlY1 kK(hd pqbT8W:y2_ ;kU`n* ,% "\SC(YJw' FAϊ#W-Eٔ'-:XʗZ0,q鮵D৸Ĵٴ&)Q?1`qu $Cj^_ JRӤeY҆M%S%XJZRO~1hm8,3iĴ)>bXAE+_Ih>%u/"/I9t-|0T(*ܴ6۬4b9#A!OB;#Tn 2yu.oR@cGDD 9OY""Bp1L^ eE\@6o&j#sPćuP9\QTt޴%\^~Nd׉ ;6놷r%jicpo;LɣB1^nlXܣ)aέˤCp`4<;o?Twgky ;#**Ɇ%tT]J~t@j̶mSnA&05lcDӜX7p8t"V3\;mb"OKmăo}m}4ytc ܐ/18BWPd`o3kb8:b=qJ.'/.H;Ue !G>q{ k s<氿i Dz;]ԯQˆ:zQjZ6ԢYGId`_W bmgD}8co}{zO`PE{n}1Xiy-$rj959h@,{^'">^So3dƍ.YDD 9TOY""Bp1L^ eE]@6o%j#sPćaPJDNAf1瀀p̛f.+2}b*aeZ6:&P8m ZK1-a ~(?+줢bw7Ӊ_bJm=1-vjscWA~Go`oV^Cno3 <]3GOcѲv4>~\H(`gבI㑅4N37%E =8 ZDRִSfudl\JM&AGX姎_.ݹ_YRk oHv^|6G-b vJ|P !7!dz {oh𤝥V9OIISWUT+0i@K6qI'roxé,a>' 5}M e]%vݵ SܧXx@Km&TSؒ*I'y6s-ugS=[ih#bzNQv֓qXwƦ$S$ryv$)4z^Y R3 .]'̜&Ws=g.j3MFI'.ĕ a4o2U!eZdUϕzV'57u*3e4YE1>,]؅q*j &g@MtSӍCOꨫJ vZoG#qzMĠ YZ Ft9im:KopF /R0%* f9}#LX}g5Hs-׾3ךوď,uM5P6 O05~7Q+_cccFS?zVRTk63 :z$hQ0Ŧ+R |ݷ3Ta<[i}7W":~.*Pr6 g5^#Xjk0T-m( <*[߰p<+qfiAhڜ0AMI5C'Y-uϟ_sG|DD 9OY""Bp1L^ eE^@6o$j#sPćMPf,O !a#J,KpLoӻQ>fiTRɻbG,p|oU![~q^^giwuJ1n^Y {{ wšlw3)eʨuU FVG#4nm3F]>i3SSӸѤl@>H.ABʓ6Y*٩iiY 7ϑJʊyLtoZi5H8FRrn[]b.m5:!^- G~G0eRQHd 7>w'v5='V)ҮķU9 ֠er~` ?! 5uY. n[=P˳ zj^Zf&'.FAvapP0*F 1!Ƌ(;7YIv{3NX"8L*@`|]zxZ Ys/r,{`HfpNy,lMʊrfVv|oO cjHYGP&SXY˨!H¬{3/1\5=fwA}WiMNą `pe'% 0]/WSG,RSM=JjkUkazE: ̠pIr?!! )FrM0EBXM uWytz6oYzig9pYp\2ϗ#"ں6k-1a=\s ƴ:ϙ#X^O]w]V>`m`:uǢ:"TuzNK=$нDTU#EBr1򿗽!U(ē&U ]GO_k'.J7^HHr8>bR@DD 9OY""Bp1L^ eE_@6o#j#sPć9P~ak.KJ {c<ͥ䐪b$p)Ҿ>L.9y{1to Ye>y-2Vf{ 5&g{O 7ΨAU])7m-rA㏖b[E!s)slQsBm;AꮛBH0rlYj=Ogo&)]C[WJRXmڍi昌fŅg @Ҳ[ عE&d@3D*dž_>`ҢkbAYUS\6D;_qVp|T6m]+XX*bOc5Q1<5t6?rY` %Q~1{1,,"R'\v,ΦzGʪ9i݉[m$/j5-EG0jl.>_)3\:zJ &mw`> ;x:Oi{y@:kgnrMDIMQC,ҘeU7ٔyLC2& z&}hrDUpA [oQޤe?(Xj5a9ʏw[g1u'QzəҦFjI~ ϐŪT l9k<\֟ eTk%%[ 'u/SYkO@f$"棩u30b̄uSJ tQ "oZ~ h;Z Z4<.1`pl?WkAUS-+ "أ />w 3/G"zbSM[#$+p<<%t0T*ecik,q-51xHTzJXJzv#_kF>M%_zBNera`\Fd+ $I*HcU "U342+ ;V2 aiKHѰDD 9OY""Bp1L^ eE1@6uQj#sP{<ڽyPC}Qan2:gŠ)%?lj婫{eku vOƨR$8Lt|[YTpëuۮWFL!Ĵg'҄`}IQxD?_ 1;${ eeC7\@ NgBu^km/6g[1/q:Zp0?2'3N.  2):Ap)g<پRw,N5 OEEPC!~#8ݞN˝IТ-3_Wx!Mf%n+ W慎%K GR]s=:$xn^uɥ1o?sLDBBRzryR4|FxzE;B&]FK T a!V)Y!IRp3΍ڠЬlj~.,ucT_9L&,:d!#9F־,ťv㣫bF{B6_@Y*#;w'vryZr=Knt[WM*`=* d=Z7RB mp@Ię$sJڢcv8lʾ5^ S-)$`Iϧu>| 6 TrA#?.\'P _AXxv?n 00FJ㗢gO =ګvdȑ3e QэGcD^|œxh!ZJe#5LJ)P"RۙTRsc= qE?I5jŪSKĸomJRAqƆe%=|!?ZLj/\qf(!Iszӎ\Ol'UrrqGm%Ii @*<z -?_6LJ6NTY BV*PZ Gz2HE o]#ݗ)p˃S:lRF='>S5G(^n5R2s,۽(y#p jEMI.ijN?u\Hw)<+:}NoO >+d >]V%Jo>1qjyאQTBUθ}K:DD 9!OY""Bp1L^ eE2@6uPj#sP{ (ڽyPPxwP~yn}" P8)WP>sH(0:mtYd- TۅkN2F༡y"RTq"{bwCuO 7V=DcѪPX~R]qEje RJpP7d@#qKeMTzѕJP$KDm 984mH(HS>/r:aS:]KU6GK!ġ)$ JZBTJʊH л;c0GN˥T˦ޡ0)i0R1R'<3#ă'ȄW' H*ßL\*2d2VmrsؐǸ2ҦKϷ% )^c {(pN~Y1H;;RZ-*HeIa#y''U2rRk)i%)N /W1㭉88 P2!G!Aۋ ($=U>-KZP$q$:NWC "7 LFvĝI#)}* d2S*0L*-Jojh|`Zxm<%iJگOCO1 XV* y˜d9At3{DD 9ZOY""Bp1L^ eE`@6o"j#sPć%Pe^'3taekI`[ ")ޠX_Ń4v!0c OrGol@$,Q$#E@{sk7"[yQS%\$V!YW`")ESt]G+%λIõFG;(6,6aG/V9 6X Ƿ AXuu y=[OSU#_AVicMzL~IaYKK\G;̌1ɼ\-L.sL-L/ T2,\ xS,b`NS("gb.,Ep1{X.Iu)8Bt<1 }щ0c(e؞ ǔ~-M@ ZT !I8>_|^%^OH=?R*J4qn>-[|ONRi,}ϫi|#0 w"? Z|sLN' |M8pfҌM$/r1|AOCœR~)謄 w7Kn1lβj s]Ip #Y"%jlgQaNI\f+<ʈ>ڧos~)5"\C_^Vۇ\_LHd|fWdOҜ%Z5 YQR5;uv#kcDZ<Ѫ94+8«6J'LGSC5Hhor MīZGI (P"Qt^ؔTbd}ҁ})/I _3`ԩR u%AdY__,*MLx]~6QXA-^uh} Y!jJji "ۉc"Vu7Z:7\욲l*O#-I6Dc`iy2IԢIKno-5ODtΠztV3TH,6n^S|r%=Zx,Gq‰Ac͸N(kkƥ"K@:Εbۣ>a.rjB$l/\*rLe opZ{o+(p5EAmVyKJȡܴF@}qlMa7O\دœ[ఱDD 9OY""Bp1L^ eEa@6o!j#sPćP'kij]+SG$L]B 6Ŧ[|Z38a{g/gq4ia*W[ۛ xPm<0 vM@mﴙETv!WrȝZtˢ,LTied< =7l`X-,eQr'ow鳥z:Mf@#*wo5;xYx6>SQYR ̤,is:V(0Dv ֿ'\r%j/yvq1bKQC&\/sڛ߬TPeE'5-@P(lrw,Ơ X Wg9gU)əGṈzlͷX#)M2svP4?R3뉨a4n^E11jZ  k]Hۋn&A]`ΜuKK"ech=Uӷ#z4?W K=o:NI%]"x7'>P^\Q˦I[L [ *#~/|=L>`n-ɸ #hHZ rbZ‡.,kG8&"5T/LTdbP InB'y+)eMS Gًqha٤{ʲC!/H7*~CYS{y4Ri.3[M_)+a6ReT0]vZ*P"*-$𳼠yb~0R:`w> +5=$ !isB.hxHlnJ<|Nmӄ] [E񁞕0:z:t;2+PD,$/ [ۿb1pO3Sk2Z s2.i)#0gXQ]Oٞ|As"梩Q~D{[QTN -e⅙~ȏ0a ZQ FB{&eٞ.%+a $KZfsÞۊyOe768do517)6ƗIjȼ\2}|klV^MS5TYJG0I)!a 1e}kA`vjssAS-EDBneE`1Rݕ čj7Q&+ͬE }<.Ɍji<2j_)neq:^@>K49 BPccYذ':zf)/&4o qWR΄\`<%"3GUZ*-/EJJ:a=./LM_I4͠+٫l?SY-~oӓ0+eg^evaQ+8*>\\|EA24! fut%jV.k֖J.vF7m>~$%`g) D恡d9|#2u rTx,I .{XppR3,tb~KYsJUjj)＀,؏< hfKKTzrOrG'北j&T/c:fIgy Y8FO[G]4d.m%n}] s#[87]tDPu mnQcぇgZi# x\cX-ISH<@i*mpzU<81;HhsHOJNx>Ft{^ɎKOA-OGljs)vk[jTTjIF _15k oDn:]i?]K4G ;=c<}$mpFwXVb)&`}er~ǿ to$т.kš[U0TL9FS  TDZ"OടEv؏j=&YRJc,\@1}S8RdH8 ;Iew $P8wǰ2>|gNb6fy>5@n:䳭{-%GWp(r3O~:ݎ0րVD/}Y#2S ,NrKgP4qF3=q4] -(ڊ4-0^ q2IluЉpmv Cf5򉸩(T9ά-s*Bm#%[cdsݪ_d&Fwr|rN>>5+G TT롮Pܭ'j˓ L| S|BЫgUa]+ DOqooTx9iiq˝xwSvZ+2`{82Ɗ؈ms'h/>Q S$osWqH^rL\bxa}z^!Su:%i{0:2)p~C'59؍[e,QDMT-3@{;5?:͓`ԧ['+^\ 5%M4lJcOr1Hp|C[:yݾG^#ݽGUSH:r$d8~sqτ v<+Zןi u 4 }`ZڲDSDZxP"|9ζ p/A؊D/d:WniӲiz* mC(1jG C7!X:$gsND`;u1\ ۘ_g;mT٫mRLtsU|'}jcw/fci=iٻeYjm-URA >O4lvQQ:A# /_s*D4UwI^ UfMgYަf K??14D||Y \)#ȬB>5r(j4E&W"FE&B~=AM^E˷5]=uޏ{ZjO!pf y`@\|`#?02i?±s CQt>Y.ኢpYjmUV ,:?aOq] p=?Ŗ`Hǚ%>\?¬gMl|DSo$>Ggq=(oWo(!Uqɀ[AcKb:wtH$v=%mK> fhRr18sdwO.7ggP%qHߠfOa ogW0x?dQդ}}|F/rGA-]c⒴ $|cNȆx2>cߧBR^(P @ 9δ1fdAQ=UQ2G.= {GK@C)k@;h?vֻJ9ކU&` FH[$}Kcx.k!v>~_ *R%,jV_|윱{mo9h>g쮻zx0A22i撋 -'zO6T.$Qf|pGǛe2];8L,|GK7b;{&H#":3>,.uI3|l*7I",!Jq:QRkS~ $|^~kPE4)ٔ/Ds梨h\FuII&mykpY*^6X`;:?ib䍌<͋ Z|[$֪DD 9OY""Bp1L^ eE@6̡j#sP\EIPZEHjV< = >w+OPl6T@*Yrf ĶNuh䅽 ?XACO6Y-4BI<ʋH*Kgj]@Y4.hҷETR\(puL.>:Q"Icu-& &Ij*LcO8@5Ż4is\=(fW;IG읆LyYTCw ,w&xd|eĎpK\;:1$ q5L8AI'5}q$mUAYH|#يe # oU0LT1L<I-$gcZ[tܻnxV8etqdag3B= SgؕNdڊL C;u6gujmI7O~`% nmzQ*miܵr(^2K#+}ˆK76LV_Zy-3|MjOn#=LݴU+Q\.Y~tyˀkA:N֒y=+!zihZ3ޥ<vx`(#3LH=ỉo1loGkY.7 $XeBD{?IQZ#-F= DD 9٫OY""Bp1L^ eE@6̠j#sPaEIP*I"c}:vH G~uRAeǷs\bR|eyW0XR핕5$Ij;Xbh(f3khĒ,uJk_vt7*"q6aA~3N#B; ӧ-vVUE9Fs$W 3o:S165&Z^^ %6rNTO|jZ)h* @sf1c9:kz 7);_O=jFRV5US Ҁy7;Zj;30`tM=zbJ$om#bo;t`^>MyH>Q͏6TV۪HSKA_#F&\i9/48Elk DP.r:hOcŘTaӧwF0΅iadu`?pAz9H4쫏$oiz~*.&Y _dq&0Nx%3A[S\źr'4-%/#` F %I9pOǯъ9CFcYZ;tX;cYk(Iqz(m4/[&<\۝FHyjU$B ѐ0 lL9Hcy+ yBd֋],$naĴGr<..LdpH?=kI {HWjɦWSѐ|&id:zmDph$|Y3րqH]+f{NM qoQ*5΂Z%zWIOFGKRB-#'M] Y/o$8F`XُIr@ȒIl8Gʑ+`}-k\-ՠbddď#C!6?6ZlB)A]amMu$6ZUeC?Hc=}̑0vuEKa,[ƋAxp AXCS&ΜvK23,.O7^6IpNZF̷ֽ9 m@EֶM=LI{Ws ٶ Ez|B=($Zg\?" 0s%ۉJұ)犭Yd_׾q1,|%/Du:~8_IIX&"zhPe.0:MOã:mha>Kd9;$cKZkQ~ {IV0:jw ڂC2OQ}ڔPa˂a\%,f\v3qmMی0 6gj)a(ݐg&+%UkY4[͇5OIࠂxI5e݌BDX[g_4Lޞ14n~x@UͧqeVw54u\?XVQ-ͭasȶNH}L<4k@x%M$#FyVs%N3D 9a ߤVU+˲kk1XP bqy&@61UC( +άaWLv+; |uvʬ&Yk[4##/ w@cؐ6?N#+U@_ :V8" ܀=gn&"o|Y_poXdU0PI.;|lC̓&Pm:z]Z zaI'S+<٤)Ǻu*7(#Yfq#b3g$l=|`JQ "|?Xy"-d$e p=>Xdj\[a<ڭJ5h 6 @~⨢fDŽ?y}=~k\-Z"jO{[M3SzM[_d! 8Μ=u;u5; rb;S `ηHMaaM'v>瘊mJO#nS$oyI߬s3 (O:HݼYa,ž 6 ߏl< r#N|ꢩ&X±B*=j.Ynm]] *^K,c~_~#*eĢRҜKڝI.'M V"`rv=@MC-ԕ:ce`m텬vZeuCWUW+*2b ,@*($`QncYyZ1دU&.8.̅+aC:t&闖~WDםTj )(# d_1iӄ?C? !O6XhД_n}h.%d>?:_׵׭RŃӿNc]hÌ k<9s^1JWgjc\Mj sbI_e\6gg'ƾ*^F!J[9<('!F +r\9KCK Xi^NR]$GtyP?4Mm+iw+=xRrQi%;hCYWիZwɨP#YeEV0 r6s8e OƜeijmvnߪ..KĨS[B)>(zR,#O}ō3d"zjvCUN;S!>Y^ 9V~=/^3F?QEFWj.n@Jސy* Q8JI^ZD1IEofݢU-VI?IiM6e%$ pqRo࿦\^]UҔ)[p]0\]O QC)Xq24C'frS݌u2R!ZԦC'fJ3Oδ"tte Y[1YՌqۍ*.Krg|`AA+3Qe`s~alCj} r-nt /#V sh^F\aR*o< gj0=p9s]2<2;RwY|,mFDD 9ݬOY""Bp1L^ eEG@6:j#sPVcPOQW;TYHozy?cAFXJt9ɐ̸GG)Z!]x\ټLy)-XūUv񄴥YAN0NHq:nZQ#m TujJTVHO֫ئ] d5SSJm[A:+Ba2-j!`n ,$\eh%8J==BB/%S)P!I߰t(dT*B}U{bAkJ}(HӦJq}=>%p2A#'ƳB:ތz䨮'bJ$+ Tq.,r΅(Ĭn+JR]Z}8ii\B%iBIppxcEh (\1 "]yQ(cHƧ7c(TZm UzG}5y䑑jrr rEXET)d}rYs`bJ[Hem䶆J(AVI=VH"5w-[[,n7;  >>EY2JVR}#Ր8I?ְS&Ҥ?&T.Q2!g خ^'{&^pEyJ,6n쭧?6SP[e_?Tc3Pv+0BFYH|w* {^bqX[AB)GӲIΜî- K%@j߳\"ATbS$ z6XaDD 9:OY""Bp1L^ eEI@68j#sPVmPPRVոskUe7tVC2mqRqSBYTS`T߂sR+wdUv]kX te4 هP\p #|iҴњeZM&cVJ 4$NwHOѲӋEnK<>F4T" 6Ǖ95 _k %-0J;H2i>QZDmoK> [ ʤmq>ݲMvYyr4isk~c 88Oa7;~vz˴jCtː&hpX/zTw-J'<pr4_v굧NWZqC,D <] !@D % )]vYY"K5U[TK'aIJ=j$UJ1}:TvTK-(~xj3\_v"$%D^دjuo%)Љa>CK#`* iIFL1ˠ]`Y˨ŶIa֣ReI-QJ\ udJ {?, w"G n:M>5HECXK4%@(# ǾžkEJR엗)(V3c Q6WjoDvn1qD9$%#Jx\T{Ժ=ne$8:)#K onSߐR\)#KJhgѡ9iuk _DJn SKTI;FGIX&5 8f+HCW@`ՑoU(!S˕h-meũDJ#b ˨+m郎Wnej5:M%RTCm ڔ!XKXq:-'FVf+J)qD}N6ʔCc*ړ(C_U6urP YC!M%Q;s;9jE(Jt;mS)Bľ_@(*K JIpO9~yzdT3bK!q( *'#B,:}էk7eH.)j;]4KRHe-` ~28`x;c͊QUoո*gD*2ql1gɱ, QvE~IpaܢӽEPRi!OWP 6?뢟 'OS|T6?P5K\JݧiP*΁rY]M/[S,{Uq#(Kpw:;wM+9OS(eݭlGU*[coǏc Hjǿr;9=OTT Tn AiE9<|6HlY8^#9%.$JPGZX\)qHAsE%8=RIz)}^ܑ'<:8$ μa4}_$kozu-ɤI$>~K/Cע4xwјPPgU)d2|p|Y1vtbtYں/d~+<C7FF9H?$V;\;ZWG9)8bB2:ˊ)#Ya166Czf7 u]MWx!xkG3\nם~;@!#3G4@|İQnj]Nڪ;l*G7Ҧ>-5j1WD6G]ȍ5"76. ?hI33] ;Z7dMGJ1~Jōp>u3O[: tP;ڔDD 97OY""Bp1L^ eE@6̞j#sPkEIPv:WU[6m"5Eix^D2H N7bP[?7Wc<|^ QV* 'NVP8֕qNxHoRSZ+3TSZ掱xUu W'{j5\lpڴAg Ĕt.DH\r5Vl?g^a[4:mת^\29^wi}:(+$EJ>-ȃ䎾ד-7ײa :SV-9i)!1|G~~w2\0e&w fIj\lKhU]n L0e*?nν˸1o|h$ iky=%9lx2G HO4[ ڠE֨M- QZk>V}X-C1i骘LV 7CB>5tl/ɰGh{Xyycd^`ddYl϶{~}ME|, #cGzI{L&ġhV?|WeDHL#|oh|7-@# 1Ν#t:/DP!^gk上I%Ԥ, C#KEFKK(l>$U{ ~ïDs١g gaDFq{ep( K9 ;9=w1`j^[DTY !"$LK8X#S#ס/n[p~H;4ԓyNM>29q|x,L.Bl7ëoq֦YQdDD 9OY""Bp1L^ eE@6j#sPIȈPi"Su7l>w'癢Vd ~Ii+DE*{~:T46Ur@?\jokЭ ߹)5H FS@=^r"_7z [춍Mu 2Xr`zcV5dJ?P\~ݴVZZ+‪WEVXoAף\S޷v H*jf8pP, 4M#txzR5.y\Z`#Uxq! /tӮ:gH.b[Y-mQO$qYTW'8=ay3KlzM9Ϩ%^{oVG,u**/KA@q֞&=--M MDcVĨ8u1Qj,Ԓ+I=T . ߚ4 ڭbrYQiWdg2 ˧>ks0mʛ=$^Pyz(]PMp]Ut2u9GK`VD 9' r W'`!-V{r~DZ 'J5m壑U|-zǥw7%W/FsRU\W(Z g1/KX5W,?`* ]Ej۶Otjve{2 /qׯm1iʚSAPLCӯl}5\X9R]l+F}ƑUj$csQJIprv#d^25V.'G_'-R[RJXff $ub$[7S+yy 8D×?uet˖S Bu5) H9ley@I75&%s nz4,# <0qcjYZY^4ab\t0'>Ʈ |àԵDYZS)X~zVhs7$yjɮ{U,1#԰(ΨGN^llRB5 wEo,srD'=7T*sNĠv4Bnup3?"=%Z?_<ańD{nQ.%'nHuOP%taՀyc #[KM9DCxC[Wg,_׶i^)܍Z?>&Jr m]yY*3ᤤCϖsd<<; ?f.zO3.Z0F29`Ğ'=i"[MVKVٔv[Jr̸i%V"G?6~cӕZ+2dF8ƽzPpjdG4%sN2?<|#N;p\m6槩枤j\<>ϯoKxG>yx~Dqn]w[=KdIg-$FϩyԹlI`\UQ[ Ts kl=1}5>zI%.^bZC /1^)lŮLӜZk]Gޒ? @,1_Ȗc^P/5o> o(5 lc+}QGƲ49&8p .ٖdz7/10=N=us gĢiUǸ4O]5i ;.LTiD% tfI5fn,s wϦ&(LRI7wʖ~.Hz˧dbȖ9Cܲc*:'afW.${Y D ;|`:ytN[*n41qK.{%{&r ?0b# =4c" Ͳ[-% $$p<6wF.XrG n\k3*bV*A9r>~Z l.Eh:;-(TEHP˖vpVAɻ3DD 99OY""Bp1L^ eE@6j#sPI|ȈP_C^T[|nT-K:TK2y:/aEQ4UrU[iɄ,ǩ=;lIC,SCKY!Bk!*~Ʉ-~Mď5c%K c a2*h"թ17ꖫZ$X XA2?-;5ɰ+i):O,{sUC:OY+27B. :=}\pwQ2yq`0D{6k <\߆f> Ttkn ^\7R_yjz 0#чp| %(17-1eJWd d86@IRQ aMha,#:{ jIeLmj~r#W+xᤞchX X8IytJWJ#,goM9d.6*)EUidXG]t'\pbGP@|M6]njڹ$,Qo..::r.t6a IYxU˞`Ry@zzk˖BV:6WOW;-ED x=V̶fD5P (u^u6I=Ԥ!EB~W7Z {A?hBZZ!Rꭗh$aX$C>Ypwau8p5:#H'fT ?I/"W:MYU$C 7F۽OŅaΧ^{yD4eY:@95L6<܋}}o^ m{,W KTtҭ:nCXcI.rž e/T;;$\qNpW͡wlcT1PTjzQ]P&7/\>}0c6;r:qObMHq բq1=Fz(b IrtS8iEj,HVRXpH{3*CXt<ɓ^{7\Jڑ5,L䟋=ӧ~ة}Gel+312cGsH;DD 9iOY""Bp1L^ eEJ@67j#sPVrP젰-8/(;{p'Iź:c(`WgۨBm:ļT)PD3ƺr\V5hY=n՘TDdʀOFږvg'1EAKf}Q.rf#;m z @j4}MrlQm&mU8 KD[O?c ʆ2pA hſi'qp`ĪP֤%J)B@8=:f-rʧ7F㽌cA'Sye;MnĬԔP^PG2?uB<uGF1i"~SQ"ZC-8RW ؍:웃oHI.)(RݷڈڙU*bM)(Br8$η&bz)iWfCXH()}FRE8i)Σ w+ƌR}c#Q$0۱UJTVq+*9hliU$ RJS("n{ X1񢦥Ю:_I1R%(G)Ͽ8ťV' `윯k2PR)৞yf/ $Ks]"T*1(r,|$H.0r\ݑF@[PnHΥQ1M)0=UߝORn@=U$nlmKn>)BHO}8#u)ɵQЫO[[v\]T@mH*B J sE):eQkt`UM,z[ KA.v{sκ#(1e w{Yi4ӖiMi3ф1^6[B6|,EV+Mg4# _лҤO:,.q205n`(:/5ПUƋdm%Ҧfc T8@Z;P$g77zfMaG6ܐUA譼=Q 3BZ]T~QJD )RGZ~V:m05~JWt٨" ]X87kX."_V%2jOL5Fm )V3R}?&I>oKײݎGvh4ܓ7 /epӨr֓1H;M3;.K=6WT|ɫUڔe]%%"=J DYZps?Rr{BZ@ ~=Ĵ(Hr$9CJ%R88@ ~V)6;0[t㌾̹% .3P|h]QyשIs2Ip])#i>tϭaމȮxtںU!6`c$[ݜFjC䧣QzZlߩ(Zڏ_Sj}KGl(:})y+0 齢U0}E^ ZG >[]{b*Bl,5en%,w}uLBqȵ"FL#kK^T1htrvjIPn9ܰsq߾2)>ՍcEv1mv 2bOC7]Yo"56L|cSrK7BF\Y"AR<y})oUm JEHo\BC~J;vq+JTΞuW˷tߴJQl/Qjc?䮖˘}58gmиh;"tTf Ui JSQ ~}Ʒ(|.ð3?P󌋆ɚk9#6d:~QB(+f^ŽuBRMER6=90ιg# EoK.Roӛ ו,p`䏾5޲ܔv*"o@[HuD ăgGa9#1Om\^SKYnRp}u(Z)5L֝χ5v\a\J[l+6C}{W՚nEjjr=EB۰je-:TiͪB*Jr–jjɤd>*ٓ/ 9&Ό"2'Ψ%Ir=*KB?4vfpuh9϶ţWնYrք;R ZN`{i؃ܺUN)( ڢH}}ҹ|2>T[NL!DOn=*HդqVa?ytޜH5\"^(?^ HeShP_Y}8Eܓ_ݗY܋nIQJn ;Osĺh/P:~Q 4*mdʛQW3oHīlDp gL^2y@k: uAVߘS`)gCu{HJR[)GRA1ms?G AW Wh8^K`R{12Ɨ@BJ$R[`䘒?)KX2=mƌ( p=n<3˞j#_%1]GȸӢAԅy+% ' gQQe]PUn vFd:_ eo>!( AIP #GjA&+3gDd%R)XY*PH ǿn !e?[VlWioJ- j[!-qBa uHMc}~ftK|Se-HXKJ|t!krmTi(p?"ϭƒJCISw!kY^ jQ~f X*\G$HqA*t(UUT %m[q H϶F4ch @RzGmjͷW l' [aaK;sRhDX 9OY66L^ eBp1E(Q@}sj#PVqPحXX 9ʽOY66L^ eBp1E(Q@}sj#PVqPحXD 9,OY""Bp1L^ eE@6̝j#sPpEIP[&OnbaJ㶟>ƓGv}=5U5EDu޴5 Q_ u pLTTφIμ[eQmЍD|ޤ+:|1Y[pT)O0gnuQ?ƴ!.-dNc릋+|(]#ϴw`}X|7[t+ 1 Ϸʋuq ~gԯMg3h|QJZ[5U)q$|&0pw>}Uhbwv@YԳ8{C~d 6aJ|ҚbdƇ!%{׷3/zN4T?+Hmj}ϺjeY K5F0HɜS|6b:`_yM:7; \^vܟ+GV+穚yojcxܑAhaU#}i w-c_s Ki[7uw6eZ7J$0FGa$SeGZsZ$.oަ\=5gIBV$y([Y-ٌy 4GOu2\"{rL {=d;uc]~C1;Ns6hnI!b?Ը: u=tbY裩 Ydj *( DD 9|OY""Bp1L^ eE@6̜j#sPumEIP[A_63FaSb?t!k*^jެ[(=7d Z7nr9#?8׌nyVQǝ-<o!5|Gn=Q4Q9bGcz0, hiC2e!뿸wO[Ap)~ۉ,Oyן,Z;܄mi&+.ԣMA ~ 54ѓlOKf7>8\jyKB`%PCXm\BT{~\Kx1־h;W kƫ0Ҙeǎ CJOS5(4*cxȌ2`F(UsFqGBvY,ƞM"/RcT`7'e9Icp1xvUZ|:y![w%[})#EoH oHE;1W{=Gȷ-㧩$<0;A#p:?[l|:s8rp}ۙbC%=փ>۷}͸}HE9-9'tQ̒Z?'ouOsf- GCg'&k{ 2N-Z;4œ1GOTy\Fqƽ 2cE'oztf7]@}JV[EOQ3FO3rgH{~DD 9OY""Bp1L^ eE@6̛j#sPzYEIPYvrEuMվ%M*ݝK+%PKyb$u?yZ;VvDhg\7Z4VU&*ŽL`iaiz]S&I=}G*jaD̑9ߓbJ(OF縑R.Ŀe3),G\0~?mh瀛 <un˭c4T1*r#Aƽ>33$֒~lOhMtU,QQ'ȼ /##?g[Pǂ`$`r:sUH"2ǐAYZieK#a7ߙrx?~5zD*:s']`xk?}G6E[OoQbJULIKI뱝p#^6 b1:CɧwZqMQg9e g^sW3sؑo4ٿ$?XA$pAK'j }M#n0Pw3˻vq[կin֘i驥+m1hݼl">2G@y|a){ί? ԯdfL~F6;Mm5gr:zHێq##T-|Z}]8d!殣B~:"#j[O2)rgI7%A}BwnTn A{P0Ľwj0o"k*!̮J0Ǒ֬ tRc{hJA?}0)GDD 9OY""Bp1L^ eE@6̚j#sPEEIPKN,9U)q'r]BքbdFA=vnskPڞ{xx*8koA=4Jx0ϝ_=Ph )iRߵ ค|\ij>eNGȹnۭEo/퀩x99$ ^eiZ]^/+#3}:m*9jmOwyjȇazTRԤGRB8:B-jUԜG;Uh޶Oq"(*`29I$uP#2|k`"G0˅댟yjR@3Te1b15YS\6 n^.QSG#~\VORHl(S$ qS<45f<,IL/fF<{ݝ Xg>?3[NCNi}5JK#JMv>"[73HkUv{zyuQRDAN: d5pI8C^SjTP.YO8坎F!t<4(]CieTةbHN>Y}SDq N.>]5tRv֍Q -ƲbT,sK?ڷrmUPz d6rC[O*XI="6k E 642l@fBQjVGEi"u#"CCY7jDD 9HOY""Bp1L^ eE@6j#sPITȈP5©̩U 5hESqVmYgJ[lv)d55qSz­79w})&PH6_nWk5x%]\eYzdeKiDK|1(THUtIumeښi. [ ;_CϩI*I$s0HG᥆ G22E/ЎT}4 v=o->L/tͅ+mMtDՉ9'8+%l bGAQSU j?inL#TQxdqG-E!6?2]/ruL%Ջ$^* F}S6ToѸ%Hi.|i͒zqpBNUo{N;cUF u0(5#J;h;vVV1=ƊPS>+ёx}%Ј)’'\RaۉzW9#Mf<[[,+tUj!PdzȈS1GaI2ڃhcO"Ls6;n~rМ}5~dr9eْ{iZr]St3h2>6ePEΓɣWWa~\!QM7, ~zDf8T t;_4\JeK۪<]XnșXN5$i߸~Y*? Oi2T\ 0d !,ܣd5|p P8Y1i[/%Hr{[9:g4s&VJuAr.R6U|쪩U! >$b9%&Md/H9##`vFPq\ѲG%=?9Oe5tU(F@bg&J rȊ&U<%DD 9{OY""Bp1L^ eE@6j#sPI@ȈP~Z^b\6zvR{3Hw\Lg~NeCfT ĩ 7p~GMpg<HCyGe9'`=~ Ɩt@wuM;gM~ VUZj##Єb3RY>V@t WI A=D,Կ8'=cx2|7^v-\NY5^VE@dhi' [2uؼDEh~nED8>ʫQ5Mo9R _Y+^> W[$W޶ pB)IT>&YZ}Ųƙitxxoq7nޑ4Xg XMLe9Z}*),|y4m;IiQzF%YPp 4V%a`+C=3SG!\2&-RoPn\eyÑ׹NJꑖ=(ŋEjT{)Y"_ H)a߮cA uV kxd,Q,U撋pKyny=vut1wnլU`2B*:kFHFeqFgz$) \Y#Ctr߾? Bʷ߰:aKЋ5ᵒ<̲;2<44hex⤃ZurP41ה_Yhqmx4N?fW}FUBKo Ab*Q%2,&G =c4V+ihh\SU2ArGFV5=}i)S |<A=zX'#炖 H>IZmw0U-~!SۑHʎ;<(Z#p=tE4Dʘ\`.68Љ:zNj**y!e^Îa9TP]ڴ%ixΤWG8o.#g/ʰ8YN.`Knp 5)Ä:2w)50Yja{U [cpH]}nW ˛7 լu4t 5.^U-W1e(|W_v&ȉHXy ppqѪ`܉Ó􎖪$fʺȟ胑ֳV =mkbi") )GB^eCcӦteH>;|ZUEcU^ d$9:h\Smfѻ[)x[Ue Bg= JMM2L*9p0Aζ(Ͷ},[mz3Lj!d+!#'5\ޜoTmspNNOY6hm#r.6nyEQ$ ټ61aQUX+`dC;XTJ0¤%M?53FJ3.f"ʘ8MEkRh+?Qylv\|и6FMvEr+#=EY]ӫQԘoǩŸ0xjx]_8*X_+{K0#9veTڴ KNJv ~'!Ɯ*cN &ЪIs!)Γs%5%dCqiҦD[ /EۃWycEe$N3 AO\&G'J88J6`X+˫ Te;Uڳd6ҍ~fi]hi'-MͷKE=ڥMc'bDD 9OY""Bp1L^ eEN@63j#sPVqPՆ576~ *ú\GU:󾱕l)=!`Q}|KPP)-W_\RQ҂'iW-hQUn:+lzJaܗU(ĭjRB&rTn*#4QP<8cMK؍L[T-?eىY/͖V9?J)X.~J0[dq?95Cv?:?:j,`G;+Y+peFU,)C⥴a訦+B볧]>[M<|Ւ|nC&+֏\[ɺ>T#q? ~D[k'WoqҊ*1ӝ|#zHF1}'nTY{!x;7Y>+sTIJŅoBe$` W{"SŸhFq)nFy23>?B w:VHnY'y<H`b{EhMZA ~xƍn)W4z!F n(2)J)'Dj{dH.9+֔' h%fKBqہI 48q S`~Mŋ.-c^fU5$xecEmJ*M*u$gb1H#J[c(>.tREĦjԪR2qse89Iz(~>ܗfF5yqDD 9OY""Bp1L^ eEO@62j#sPV]P`#K{AXt=HTRIpP79?nd q.i4f5L'1Ţ> OWI#ɌCnJHRJOR}~3+q*ݎw~Bf*x?Wᮌa/EME#2#1!.#/gxR}u[ōe&Sjd*l2Ӳ!8t rA?-n,%:25߬jF+)AZeJ^s:n,?F:\t֋NyP+uhv۞Vfli$l:DEWM(VyhR(~ T7Z@'@ :\-[miJNƅ)>Ԓ4CiL]'n%JKU(L᜔yN8n$4@OљhFw Rsɔ T;z5,2.]JBHL4ƇȻU Z\C3,*Xڕ!JaK":b~Ҫڳ\ft)P_i[T[(IA!JR_$0[BQSΊtj+ZBu ~羀Qx6d4 *Fb;R꒢.'j;35|Wimc&:ynPgA0 iBjP C쓪Q>^zeSKӓ'ƻc3=s]̪"'ɤTw IʒAJ#ĖxaO[]SSn,v B^Y%^NnK+]1nZhVROC4)ڔ;N=Ƈ&3ɶ %PcQ+?NǓ/ZA*XI?. UvPo%/b3%ArԔԌDD 9HOY""Bp1L^ eEP@61j#sPVIPd=X.ָWjHlQ|OwO5Xo,^%u9Rܓ963#xJ)Ћɸ۪<*_/͆4ғy=϶֍kZ[׋Q]㎹>kvp0\8`[m|eu[jeqT 3zP~; U݉u5\KUTWg1N@qgy+Mqe)J*H集٨]>(u]^#̩RR+* t6+]Wzuא%mc$9GIqe0˚f`TFdXQ?kQBb1$W)AAjazBO)KK)?aeEO(!2{S/Ӌy?@uz*%Ϧ)R9F"Х? i HRq2>XZeK IZ'$"5uQګ$$ [؂_j+(għ\ϡsh<[=? rTx0>B'~BxڦϨubj4А|gk(>N-bݏ^QzU48V*196rRTkzTL8։zM%TT*q؃-,W%#nGoՕrj~!]c:9]5ʢiq]-V^=e.8vi-z*mIKa֑{,3 -u}5 B:jKMNV3&B .0c<YH/"Fz&֤/ς2STdA*RS4\ǤFz;뮝HLzMvJެ1،7!~Z]ZT3v?UZgj_mV͹!Te$:`$tvHc2D۪B=*V[i_$HOecHTƞ.:J)#҅Szi$?qγD 9yOYmmBp1L^ eE_Q@6j#sPV5P=Qn9>j}. ,GlT }Š`HI졓F5Ei#:$Y 1M@'#A,T!Q*T>M%"qOR.&B`xW?MaW)[URJ9YQԞo4ΝC꽥W6BR"?D!Eb [R} !Ct*^|]P=l0tXRZH"=,J֤D 9䟾ٜAgT|dt.vO0mz*-JBmlIH9P>)4 mź[R4u֕.&WףsRn⒳)*T [7'LRwn6G? Q=i.؎+]^<~+jI'r4ae^,t _(wzjuӘ~0%ԲIܐTU`Ib"Hf⨯s4nCȬe#ڷ)ԮIJI3F׋}Jr.JDY.Z*(JÍ6l8#}skײ&gڈK +9Onc1 Q d,xt)5c6*+7JjTıYSٖK.ȭ6m+F%*XkcÅF*cDimdւS9t%Hr')oRku,M*a<<Ձی%=&a&)oh#tSgVjqҝiACGK[YVs>]U)]GTxRT|+5#ƱD 9OY""Bp1L^ eE@6̙j#sPل1EIPJ^,$2}hAօ i֍%z%Rn F.[r(MJCR"Dr'=N6r27_ ]EEGlT-PGtbF8rjWl/%]>ߔ n4kM\ӭRJJK MNatnzkE7EYf)i+&g|=:}B@~ew%'9m K;Y #O p PǷM0ysK- lWf D̛sA{r8e5jG}9ն5cP,X R(|cN3t&hܛ$l=ƀotζkͣ;5SO\hL&J8$?}C[Myqkw]j^ċWUeȡ!K4_Ġ8wvR<yb wy:"H{*Œrq4nEpku|xCIa!&L Xq׌]OR(.x~5=/׫* wSeG8¹ ~~9̷kj̘G,-trj߲f߳o׷v Mꧺ¾88˸-', `gge1c_Lj۾n[MU[6nK"G>1rU$ov9 vJhשǿu*S+u{v)PF!1q cYTmۄG8w*3*:;u:N֖$$ǁA*2Ysv~E^uЊvK궯vwYd/(gXnmǑ?/e:5Nz ]StyڶS G 鸫v\6@udFwUho-dv-f죑`N'UBϥ>0: jI7Z?蟫Cx /DD 9OY""Bp1L^ eE@6̘j#sPىEIPM*薚UbU_h䦎(ґ"=BG7F}([MnXe1Fԋ3!W@eoxЌaru7}_YH{`nݪ+^*ŽUAo:%Ъ8Zwk]i6ǧ5文 jD,qLnaǐiP新uv\ +Otb4ww1أoJHco(,1@:,b#F$>jny;.yHqbGcqo5jCm5b.>m/SP(m&Ţ-Dyy9CCx5 n3^^Zm/Ek?k=dO3 72 9aj@n -s_i߻GdTŶlbw nh'$$Ι:di:=-tQ D)b`1A Ev& ] p:C?È̒'9\ASFcgFd;ⱃOy0Jmڭ;;'ulm."W[Qdx$Dp gN#NtZ-m;J6ݡu4d~D T]A .$1Z5Iwoz`^nͩoSQ=E rмHR$b'9$y@#Bizo]Uv٧۔פTA`FilbF435K$޺/laҵW[j kYIxM|cqe)Ө.>z?=Co/T[%ږZh 'V4_5SGP?W};l=M[[<0PMQp}Rs5z;|Rvmz9C)qKQUUR29Ǟ$s{!C hH;k5VїkWlOaYD]K#˞~~q;ۥ+ v~]Cw_nϳuErtT4N1e08f%̀{_mP0n=F#SܬRzS(cBU@xƲFT&C^\G/Q:H@ ܻö*S]%}҂*"SP D34d{'8X]N.նzd[iȬ裠ii*3Ivq`5rQ]4a+=kE5:˕b<J1JS1򣇑;}shC<z *.H(8!q(*TebTc#j*\T?u 9%=e yyli_Weg۫hmTkREsB{= eG= }Ujն'%4b _ݝg8IiWsinP-kjj:M( tH,ŀjX_Y! )"QLJ̃吽hP:뇦UC!j5h*h/5l8G' ?] zcYo-;?Um$KqG9 aJC[Hȗk^d @3'#>NtrOڤ %W%P}wZeu,Q/& lQj]K'D 9DOYjjBp1L^ eE\@6Nj#sPْEIPĩgQ}Wny Z*@a?ːѫ._$ 9tOYBp1L^ eE@6j#sPIȈPlپע;Z2('Q]zjw~H{XTǐӔGӪ}mUm+YCz_m~U|pKQ+NRը%)_@nIEi(_l.q:S&[Ĕ5i[)aDuA0 fjTO0ǘ5Bno})`i]\(w4uOD Y5“ܑۨSnBrj%zïjX82n9a-JJI%CWkӼ4ח*"UI]4]|@ƂsO5 UblA=F:v?֊f© $NdBfN Pjj?LW )M4u{y!(Bz w/EI;IIızZQF7;yHʤV=hjYg7[kl(5صl>XkD4sE;5>M_o̱Q\ \Os iUDX 9OY66L^ eBp1E(Q@zsj#P&zupPXX 9OY66L^ eBp1E(Q@zsj#P&zupPX 9OYL^ eBp1EQ@sj#Pڽy{CP$GET /video_kankan/images/videos/10663-jtwj.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9OYL^ eBp1EQ@sj#Pڽy{CP$GET /video_kankan/images/videos/10663-jtwj.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9PYL^ eBp1EQ@sj#PVlP&GET /video_kankan/images/videos/18132-wptg.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9PYL^ eBp1EQ@sj#PVlP&GET /video_kankan/images/videos/18132-wptg.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9PYL^ eBp1EQ@sj#P/P 9GET /video_kankan/images/videos/1948-4c447fb7208d3.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8  9! PYL^ eBp1EQ@sj#P/P 9GET /video_kankan/images/videos/1948-4c447fb7208d3.jpg HTTP/1.1 Host: pic.1kxun.com Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.22 (KHTML, like Gecko) Chrome/25.0.1364.152 Safari/537.22 Referer: http://ad.1kxun.com/mac Accept-Encoding: gzip,deflate Accept-Language: en-us,en Accept-Charset: iso-8859-1,*,utf-8 D 9zPY""Bp1L^ eEO@62j#sPzup&P{eBlZb܇?ֿ-+l DYEHu@#'Xu{O[.ۉK~ l6QOka{߻aTzF. ie-sEuڇҏK/ uޯ(Ų4mN\Qu҇uFWʿ#!hc&>eYJY g8{a~qn;>~C+f5V[semXG?@QwwK˷cr˵_O-6nmC_Nk2n-_ ^ g:XRi+&qS׾vϳ{-bVqkmS@[fd<ٟVc.H-a#ZZe7cHeh-nm=߿z^]!V ]VXsw;sٕk]lg"@%&Ї2E.e\|vC}4G [}s۶7Iޚa/afp]-a`xŞ[vd>?5ަ[T徐'BT0&0ǂ]2q?YDQ2I[Ͳ.haTT}][v2*U殙xcIvc_[˩FedN ٩W!6sI>nx?[Lͣ 9kC|浣_g Ƿ۟)^M OU<)XZN5f?}$,tk72L.sIx]# K$'9ߝY_m *clEu `&b7~w5`t^ ꖜzn}N CwK@ɮ,/~;޺Zʭv@MDX:\oU4kjh鹍!M>`S]c+>n#hẗT3 =,ꙑU^LZ՗]$'?V8XD4ʿWs0z 5iw5X^ܬw}~6(?8Y]1hՏhsݾs?DL=xspw/Gè=tGB㾇xkp-'w5=yLhּI'5muS[MxԢl5~ś\nKOѬ'յݡXk[>$;vّ[ZY%Q_Z~!쉂ZH 9k^Ӿtʰ6^˛k'cmަ6Ƿ5۽[\!WW )KZ4Q%zYX {;?k|?5T‡>å>r hpCg;kaiRlh$5bu (DڼFV+qNaTUs]`pV.0p\잧}xRO\=:wװ.4WCM"kaetUMhȧԪ|M8} .x`-k߻-ĀMy=CslPYH?oѷ1~-(egJ"r< \>t.+x\a{:ḵg>T1u>NXW\ր-v I?I oӷw$ƫ0W98ϲ+7nIAT?/AmñN9qtD-ޣ.wUMUƀ ;V^L&hZ&ZqSHXvnɳ6MVv KۏCi4zyg鿝U:G×F5lggҫ~?"02lb:fNz6n$ƀc31\>o1NB@W˯ֻ #Ks]et2},zֵX~Iw}gvuuMX_ө [HV5e)pd4[ٟ8%#kl9ch4!98WYX+eo7~]p)vWg%DD 9ۄPY""Bp1L^ eEQ@60j#sPzH&P_qm5fv ͻ-n>+X:mY2\}*[[ZH:X_.4t|:F>S92[b2:X˾ڞksO gwOjLXFZOm6sɈϙYא I$'jZfLJrfu=}89ot2 H'jxvbɠ5@wc;?v+YK6[]61k6ӧc_H3Ep ]Qƣֽ:C<_6Sdkj8%.2H?E*%$;Ǚoήʀmdm:iMj?d|Dkʪm'Ҿ0Ͼ̲?Gͬ-~QtY}`Y?7/ѱ_k}mv㆒繤Yd`߲S#WZ||O{#/XZ)Pi Mq t{ŷF~ {n*tۭfK־C V^1#>kkcb0AͿNkz-$ ([]VLZA}%eu"wEon7rL~n#V]n{F a 985wU$=@~7jVͩ[]vNAF!{[7;&涛-C}XY?Algޞ[>Ӭة9C@i"HTDA:#lh:9\Llvr7;omOYB6y_tזeѲ>wimljycJǸs"ձ;H{7.XԾ Ke_Đ ݍ'?%EV?{>vQsJ63:SOw/~쵍49' 6 vl,7i9mmGLJhNUwIuznFΧ[zYl>rv ;\G|.6 * 몪?T[;?(C}U8C;cv~VoG+#ZOMXd9{ C8.tⷮߙlϻe NV-mKm6beWeM{p?3ٵ^h:a}=FIdwۿzR#N&ON45_Z?:Pz#AL\&G}g2|ikgC*TΏe;g}kқ1.5;k-eVX?%Od2XȏvIq%"'h~gi~O=_nWS,OWl1ǿ 'Y/k,e/\}8H>sSh-v7vqܟl:Sd]=< ʵkn89kw-,WO[:S/u#)uMc쬛iY_o(h$ג>m7۶L3_L 'fhѬgc]㵮[m'f36lᘬgp8 2/>{Zȇluޗj%t6ї),aޣm{Y1AewEɦk뭖7!kDD 9bPY""Bp1L^ eES@6.j#sPz &P"U7@ퟤWq[k~AѵXttYu21qK}ćUDoe[X`mm-yw)/ء`sEEǒC=7'w bPm]mЏPclezafuۃ 4!~gujp>E}O.ﵞ?cMHZ13WGi~Q qՐ:65jU^.#p{XݵβlxG-du-qlL긷SjqO8uM˧V@5gU_O*$fr<=~_<6_-}E5n沃3a_{vZ]s?~be:beoi~n~L]q:Lߵ0i#T^Gpb~Octt_pk;˚`70ckW:vM]c kmmj{[ˮ3_rjQWFW: w=W:W]1{_dNuص>e阏#5 uu6=OUW~IR poJW${/x{XǖUmlV?ﳋ2Ln-kr,k&>k?߮=N,[n6>O?j9x:6+NfM7uv;oz:G]9YoLU{ wc~}~^i긎&Kid6ꩱCmnO˽DjIL(2ڷ[ֱEdK'f3F3[``do^j$B=vV/w_Sz;$e=w8Xz`]e,~okYWBde7@]nְe̫f-qDX 9(PY66L^ eBp1E(Q@vsj#P&z P XX 9vPY66L^ eBp1E(Q@vsj#P&z P XD 9PY""Bp1L^ eET@6-j#sPz &PHRhAvFU%]-$Ӿu> 1\V`9.-=k&̞r)eՕ0ms->ʟ]K@g^{ilhԤI",[ OM"Zzd;.מ1Yį2YkD9i~X=2氻cK省ow4]gZs:Nv%WeeWafñs1YQ W-v>`O%b>,!&8*⌥8s^ǖm_Ks;Z=nmWrv?Q jߢ/K\Q t17AoKhego&Jȳ(1a+d8g8?ZY뢽ּ/%.O夸W No/oM_o>{2ЎFZ]Ci~g;hHǂw^^@Y:z(D;z}NvOem};: 's,܇J*+k}ntV`ܬ=V;oͷ~l[/o)lf]4ϴCp}On~D˙겿ѧ-/scmyv -:qU̻l+}:^*mSmWzw_ru}x6Uf[]F{C7}tt)Qn1O]L&͞ouOe $z='QGӏPȿfT)#3(U][W:G w =5>æᾁ{prUmsǩz{ߧrVk:5Y̢+cH~5m_[ruOQ+ƏK__^YqXK7on( =o 1mgͣVbpf-1ᢷ2r?GחUW{?}ha]fzm~b\z5zmTѝu81h,*z6aщ{]Miz԰Z>?ý6P}:1f^F 1-.~3Sk]}YrXcGKfչNUڶ*Yg"_+n&2p1~Ɉk k'۴m1PmN:FDD 98PY""Bp1L^ eEU@6,j#sPz&POڳgmYg}: \[c.xiН#Oo\[թv`nSK=k}ޟRMdUQd߲1$ׯ[m'u^-pyo:moꅗYc8MpC,9$_1/;7>iZ@զG1!YgOmt K,q[;{?;ճ~v[" #ܭ`;YeUA6u谶gzR]?Y}uSMW92zMelߨ˨ce/◱\mnk?zOWeUU3( Eǰ~NmYͦVr?"lx.m6zK*oر:Gɫ<`dۖm{jmUN&ͳ{6Z.V/]Df\ܖS cn[/v9հ^Y]PBf_NE^*fS_Kq6~?VLyW"Νu5_v;{ou~yO5~g謟[ g۱+=`9odXTs=**eO#H&ͼ^Nr-eVUmcZ?ֵ>^lWV3n2E~..MQǻӍjv GT}>>_fWU-kP붻3̶RrY?oQ{j=JHˣ :}l镴1,n -wPJuv*ߴ:c2ܟ;˽K+Z{t:5 "0w/DSXnk2oٟgpD_Y.=._f=846r1tU~^?E~V%R[CS4;acky k'{,B'S蹰]U,p|;n^zHfeXYOP%9Um=:Zs_󸾍w]폂z]>1*w)ۜ5ߵz۾__ͱ'Rỉ1R,ja.ƤMw$<@'OvߤODwI;$*8BIM!UAdoDD 9oPY""Bp1L^ eEV@6+j#sPz&PHbe PhotoshopAdobe Photoshop CS58BIM|http://ns.adobe.com/xap/1.0/ DD 9#PY""Bp1L^ eEX@6)j#sPz&Pt DD 9ݜPY""Bp1L^ eEY@6(j#sPz&P퍡 Adobed@        s!1AQa"q2B#R3b$r%C4Scs5D'6Tdt& EFVU(eufv7GWgw8HXhx)9IYiy*:JZjzm!1AQa"q2#BRbr3$4CS%cs5DT &6E'dtU7()󄔤euFVfvGWgw8HXhx9IYiy*:JZjz ?qsQW1CpŽ?lWy#?9yfKg@HX"FpYFl?D>b}z|oJ4XI`b`Q )LOQ \m*Z_yv:Mb8.>5WCZXAެ;"]W[M-m^Q5֙$Rh'4֝[0%6:kBM)g)GBFK7AMj؉-=_%XBQZ0L9وZZ]!$ e.oz_|Yk_57u2=̑Uo_ *5.{y k5͗vEzVtx=ex" Gؐ34# Ȏ]C9-6ZB[JP<¼kuvDϾ$D9~>mUyw5ͯpuɥt;k+_"E`ICC30dm{ܴ ZJՎbi.u  @H*GjÖH?chHh|MʫOby_}qy⻳DD 90PY""Bp1L^ eEZ@6'j#sPz&Pv2P~{N<;FUAm:ESO+jIZ/dzJehiZ.u{;I^,ez|V82}4MKE; e`I T'Y$өw|>ɤi1ekNRCrh"EGBMlq)r ኮqUQkO)RQލW:n嫈Z_5WM3IˈFȍS:xfTr)$"<:\C$qE=KQ^bUuZ4,HE#r1l@L.n- i9p$#b*J_=-Y\yz/ȥYHc`G+>!"Dm C`KѭȑMz!EZ v4rY~4@ %t~y&)mKR[5n9,NN~pc+-r+5'o.6,̷I3N1$)]YL yQu;8g.U]R$nvq| 6#cfcNd@Fa qQ!#Z|,k!=-FȒƗ?/<=:hd(''J:\<.8nI|;O]Zem8Րɿ@͖.΅zÞs>ׯZ5Y\yF&VXHvP9^H`ሳ7Lrd)l<5o$XyX?I\ĬRP>gDh>*uCq_t˽V^@߉.7%:[f[j"mzGq {;R#SV"6Q&;PK=οote` km>cU@vfd㢌9YQ%ȚDD 9PY""Bp1L^ eE[@6&j#sPz&P?tmP]qXzq GE(~A]09㙐$h=kiޕ+鋃B g \s&Z]+V%w(,J;uAJpiS!qZ*ǩ̊Jchl!HV#z.{/9DqZVX+`!-φ6}~ ^ 9$V4)8m?U b^ضń/ +OxfaखPW1xw.L&9֩oιydJł3A Nxrqs OQyVNtdVcZCy9W&X}(.:.XG4kΖGn*Je@u9 5ƽUeBZF{PxPN^O*<ʌݲ0l1$>PՔ]yGN$h&0aU%VВ;Wbjzo{>?|dI.7e&~YFW>ߤO]<8>V $+]b7'BpFܬoRYVe'cRP]WlZ3z*ΖS{)賓1 n#Y@e_͟}W^Nσ[|2x~~@y[Sp qfb1Lie3ꕥ6>F6fp4XI {@@& $dxD[y.yf#"=kX$kx]HaP|&nX7}/̞@}_h߼DmȡiRwg③bsjqğZh@^K?-|aԑ,/Rd 0{|Jo݆)fjq_s+_;I|g҄FѥxQx:OS\$ﻒcQl-7VW:VIeq˒8p@2Z]TrN}0I1Eq 2l P#J{fߛ}kKURQִHA86Xw4'$|> Jćt39 %lGkƙ&b/Bt/6wյ x3**Qd$nl{>wMunŧki]k|Lw7Ho%[I]TUKlG[`} P)|ϭ[Yiw*G-#=sC dv-sqwҳiڜ:Ә6YYNX,& @@UjgT A"wbrZywY.nMN#jdѻ_N29Àw46S=CFhW<OR%ա9"TZr/CQd7jjɯMաUʏPcWKW`9:ԀA\WA茵/XIc:]B#tAvR׿^ͦULcNt[XFTC|;򣎽Hj'$ҹnE0؞3L dmE+̥cA)PbfJHc'Rӭo#T_:r^yn#"Z=G0ʉ8IU!IT\i_7Inǣ=1OX } DB>gk:Z:3Eqcg*TZnj:9]ݘRӴmz NdAt >6RU R@3] yWxSKȒjkwVY5_1$I!lJyt!#n23du=%Oj4;?$vip%xvqTRԠGs&ia.crQGK-B̷RA~?N(ۦSnr!DD 9PY""Bp1L^ eE]@6$j#sPzX&P턅w02kzt0JяP NԊSPgfx~~>s5=6#C1M@4%YRC@@vDm](m7"ʭAPAѳq)o4F]jȒ*H2`81 [ZDV{˔|I T@(|[សs_;zRQ͖,ꪢJrDV9""׍y.-@OĈۚw+0W>V,IlgqR֑|-/8TI+P=H'ḡ(̤ѳ[҈j#!#_MC|hvۉc= c$̺/3q"Co;~ij3_WUazPB4m.;GXPc1>Kw4cXUqZNJă4my@I<  "245N#$R\P8JĬT@jNV0 kmnʪGny;>n}DI#1w!Jfac6-t+r!Yf?f*֧(B\bfv{̈7ހI>`3Yiˎ;f42JM-JM*Ihv.A;O4iD#5/@¢g7 ŹkHU#ܩc(GΧH˽ݼYF2W?JבkN &}f2QZ85b Υi<-Z DHX$F{7rN>eΥ~s~bkQ)3TM|hF##d1/0^]\Kp"Mw+Uv!$6bo* [!tާ(8 ^FֻcNn)|0ůnl4Xɍ~b%N0қMO07+-Դ(TBhJ"-[tޭ1:N/KmaRPO؏ fg* HceG^V$DrQjj)NS5w(ҿ+>+[taqFr8p;7mˇׄrWۮaiz&z_h7 Il @Đ)q˻DD 9-PY""Bp1L^ eE^@6#j#sPzD&PPw8G7 <_)A k]RYt?f[.-훽LQxzYG̼k9R^x@H?q̃C$bYx߲LJZ1k]Sl,atKRu#HOfVBCFǦ"lXkQ$~<đ:LI@#sևF=4^$HZ[=: b%$yTX/ N!SVZ{m(҂g5p[ n HX+!3: M<|ry9pw|g"X.Q(Q:=>@@/'D,HOde^Z=e1Cϒ֚;~5Ԏ$Cɑ!CNB=W+G3ivk%(D<]1HcLDcoiV+[1FRUG9,r69#FHՑLY z2Lx[imw,kq2D*rTPwM3:} -<1]{DD 9`PY""Bp1L^ eE_@6"j#sPz0&Pxk}m4Ra,H"2 #u$Pof0HsϏBE/%|YZR8a>i@BG%EGq.žx sLQKq"Za8@/Nju! ^h?l0g/,*:<#t/IYi׳ynd_p.f& {G__V_^iv:çYtIdv0Ԟh0i[؈cǸ~լ~`[CZP㙜\AN̿Ӥ7TG.~,9zcEuvZ͊,+dZGjPǃ&P4r˩36/5(y(~ls>fAqy* Q_ &&ϟ=Ƞ;$da8~vzڞ_8ۭrju<|5~^5/1\GĶ( ƿr>e9&"wr!0:GRYx~P)Z C= >XI 20M 1qZZ7zM dRIќe=Ӂ)To\6{7˷vzidVK#pd$* Tar#MKůu] )hܩrF#䨫|Uy } 8&K^]Ҭ,c 2J}haN?rGĩ!J58#![N,+ozW7co1k]R.G8DQٙ:M@)DƏ=~7^3H14QBi@{f^C+%X_D&Nk;иu/]tN"Ƹ>4)6mf^"n@z8FIcZ9A6eez4/+3idbn"k&+9t`T5a=6 }j ̃4? JeeR\KtmR.{2VGu PXzebi HZWjHTnS<dUS*cCڞd{\;aiу7`K\FLt@3X˙/C2Uvxسeɘp&2<}^rM<'#_y0ƍM~sy 7v= $8@KuMhTw3 %!UΝ~XĚHygE!Y@+WbOr>IlbQ.]~6`ª(iJև3Nkg5[{,ȳIB+YzH0ČWjak4WG/K8W7:n+4X$z=%OAbT \硛 Øj#~B~cNwM(̈hIR=3asNdg7ul-`o9DD NQp͢VLq1 T}x <PwJ$7~J&ֹbBDD 9ƞPY""Bp1L^ eEa@6 j#sPz&PB/@=A)2=G);{Z3FƊ>2+׾fc;Ҁ), `4ٗvfVjZi"+Pޕ+_J߲3*vYőFa;9fyB-OT%:}//qy-<ܽ&1Dl|s׫-fXӠO+%I$ta@vJrD1DޔCm$qr6u m7uZj[К *MIޝ2a'рy?T|z-Q>oJuKi#.BS}2cPI>K H6iZ}HƵW<˟^WO,ikHi8D&^u]s~u呕}ghi"0\;NqʋV2C;Pr۵OS_M~o#(;iwUEr2sD??UI SBkٙ`8F$vmS\߫^q !@#*FG1ܽˌz;Yдc$Ƨd%&8OK0$@s/o'u/$o=NGq-?]buFD_rqͳ*oLך#FJiNJhEs>95 \[μ\9ցAq: x\!7x4WgԞ362/ 1K*RA1|:mO|ʈ;4HuR9kEG1zѶ5D*]kbD2|c; D5[N4㱉0F=+[4a)6Z?gƃ'V^g1\9ŝM}X8* e>HGsD4䕼fUwoJV ~S/,yAѴT}z V39cӧwikmDD 9&PY""Bp1L^ eEb@6j#sPz&P"O3g.{oXHUUIq#½م 16D7~sC[~ҺLr-w$Q.`:vNjqqvΐsqnmcK~V!;&V+gDJ7Go[Թ?-i7Z}MqhVVb8"G*@Nvq܍Ǟϡd!:'3 g[KXX4;k&Sv(w;;M43P\Yڭ2NlŜp~X~b~peyZͽ5=*IOtޔ-k)Oz4c*CkgBCa?0C-R[WZ |*6Dc8Z8{o"xkI-'wu#ɭK%cZ/H@N9MOd z8 >נ#KR\?]6PNuƪ;937/I >Gu3`I᧵73ZM;)f~DUK09EjW~b iMi~}B:Hb ߿KRO->cHpl˿+o[2A_qI[G#<"f>8n,A)G緰fH-j}!)1'P g2;u}q|sj]˂KvIi_Nchm~UwѦA6ļ 0FɱI:[)>h/d!xny{ZY[dJ^hJ}߈wRKғ'br?5kӰӺgio, I2܏\ʟ\ݗ7w>b D`9ǭeYI B=;_6aaF}Wrxk~vJ=MCN43.O5єZŧִHAdFso_t(,mΩy)7~ܗ`;<YOo+av#?jWs?S!WTXtZ~n U:Hg/ޕeścɋƝ[Z< V9;[AkgL@OgB2𰣏zyZP{Z`RcmFvQ ́DD 9PY""Bp1L^ eE6@6uLj#sP{nڽPPԓH -ϕ/lfkkKp";H<zxd1"#gH\3XI3849 >Rv#Z! )26cq@W4jG9'sk]KVp$Hee*I2hfRk2M~SDrWGL"*388y+,ЂjhOK#O=.׭5:Kn4R`;0cϱHF?tyc2͒dUkk}Ueuy@oN4d$ȮvOw`Ien4itg/iu#Ұ\ijE!,>ew=wkV;]'Ǝ2RI.ܡ-wrDl~"7/SxrO~OޱJ)~NfFѦ\cR\Z^"o'%xṍGu*ajFIp?ڤ)B( vϭ=G2 U4Zd98 - q;:"!x*ts#3W3Ӛc =ٳJ(5>Q ,+*o Ӵ(M9/1<.yXb}$Q36yǕ/|V1"gfFGjNIl㍪ʑŠtΙ$*:OcJjuEۏOcSP}?U[ \Ue nyf?iMOZ\j k%k#xsF(G ֻ♑p^ k}6S&vIk#>Priem1},WWQh޿n'f_β9'Tj7kRgК- r gOe #Jn8-y3}O,=l7 WRqri&̓Z TzYr,kFfVL)>RrhBn2tg__b&gY'#<9I#f=&InnI{Poa<.F&VyT0{ nT]KL&+Hx8Q/ϛV d5M~8X/g0["ylQQ7;J%ڡHRhXhSs2/2D2QYGQ\ Yu$hk"m^wug8嶒a2 Ǿ2}34qgpc;Ȋ]RV8c Qtc@vHj[_I ~[Wqg.yt7hH2 ލǏVHJ0CDT"J :>Օ4G!*\k"fNm>`Ќ·s]A,[>X'm(8\C$#b-9BAW CaQJ- ;RxJO-PDp=fҍOj)_ qnq1Y/$|_O7V5ws*?6C] >.99GQ yd58+͹{`ޙ8(3E \VosPw#Y2F*P9J:-d7swsɻN-+ǚ+wg}5Ke|pg!_1ޣ Kg)3g`O Ztƙ34JS!e#v?JK,:xfɱNtFi(#i'HB?aZtf*ͭ^M4w>ʤƺWVVvBkBH qq[(]s^i=Uujm6=؏Ph\0Kp,RmarBŅQsV]=|?\Z nA:M6wsO`4o1?yN= %׆pu14_:]'\ӣKMK2l9?2O xg//㎀UƵ:QX@%iJISkn-~/-CJԭ+6P>DD 94PY""Bp1L^ eE8@6uJj#sP{ FڽP5yWM඼"kvCGUy푹5h-4@3F;FW#Ic)Brį#ʩ{ M(r?bE9nq9Px< =EsO#Iq~$Զ"$%+aXdk88LӰGL{«,h=kgo)P! ʌg8F>J7Jk{$;r*.rqSɫx{IJ #TVMG`GVe)xqzb}?Ƶ#YX9xf=,Hr I۔Pn8jcݖ\{f3>f@$ x1nl~`F7%ѯY\t,\\-j ƣn8(aWma}*̿D? aK(V3)>ysQmPvb?zBa>-3UVU Hǰ$0`fI&ܩo`{cŨ9ٜIΤK[ZgHd|n(2 yRrHuT--sڎ)&*mF?=Yӑt+ohŸpy2{;2g˦me>/z;#Ԕ5Q-{QȮ$,@Lj"_$~TV ".p>^T],YUVh4sI$0޲&ъ[_9Ꞥ ɏO,R'y_e0O:\uD߇AcC$ 8aQɜWrGw gsrjI>3c,̓@7*Vc[V--F"&qE*me~'UN9k<:f1\8"VFKP(%eHK"(xBKl2\hk;Fb\I>c7|fMS=z4H.JyW2zy|_7ώYf9˩'<;[79$y%ŒU$m^v⻳ bXƽvSY6RNK#iGԲo*n6n8#oںTEߟu?>|Z^a5ށK2wW% db*b!tyuW-ˈH"FbkӦ]J|W?>l Ǚ jWz;];)zcӳsѧ,-c6~ԖfjҤW/0F1Hzgv;_GvʢBǥMF`g=NM!>{qOKi[-n^Y$ +ZO_HsFicz[31hЯ% r: (يX\[:J58mk۶]$Ak7To1ɦ4ә[;` ߳Ȃ#6l\~Q }wZTT6NvjξSCfˣݛ/$F]X AҾ\K@K1"4vI imUB3f#OQtcc}0W'~S|K| ä@%+3֭߯cPX,,8Y8: [ܑ01~EĊv>),I>K>~k7P=~wxK2G"œkAhs׮,R [ξG2X8jM-i`k3{;C9LW]ښ<"=mܶ͝s,, nnF4n;Lݼ<[~o3KӭIltkY.n![ Xe>'r l)5YuRm-Go)6 BxaE ؍K D-kGnu$PUCIe(xધzDD 9PY""Bp1L^ eE9@6uIj#sP{%2ڽPTMo7M^,3~ 7pȸHi䕉ή?T܁r6I9LSNi ԯ<8bQuȫm6ϫ:qmճ~P3~+닩ZVpKIjSŵv G_e+x=qiLN2:[1IpGrk!#(eSG&Xl5;XZAxHqy_4+,F1I]O2qk6LMoŚZ:SI4഑&GM獌Yr9J&?'HuxL*>Ê vqs)Y$fB 2lc߭gj'Hz͗P;%>[8#L'mvYx1N\b5ǖ)U&_8'??h}vm 1X ƭћOxSΑ+3=kH俹"~& wG$veImJ'/zմ|v}{:?IXk0odO00un{0\M.g)n A:Ƿ9-XKHAlӱ FlRL`)еXf0)\7]7rZT FY3K ;k1шx I#R1>4 eMyloB@ r%sH9Y"ܬg RdlwbI_r ^߻4{Q)V&<ATE7]6]*[Hci+K,%ҹܷz@`=4?GM$S|2dd:<1/Ah1-m3zJ[>G) A RC[1a;c9j"fF7?gn%rO.¸Jũ5ȿ xǽz<[hij Ğga}NVեR(?H'h[.QՒLv?f*m=ЊE xE@>x4 vA7?,+DѪoe?DD 9ȢPY""Bp1L^ eE:@6uHj#sP{*ڽP6EOXI^ęg H;?OT2ٽ~=J/Kx[.m?FH@]vd¤)ѣ\By"̒8ZfiZjuHl#fRH4 nW{<.rh=ӐAbjJaLC%Hd 4JT:nTG?;uHBِ%r=sZaTdڣeNm GHIwm!s#T{ 9/#/.:ƊBɧKu6#m&m tR}a5J_(JKjC֒S $d`vRk+ŴU5fuV |P# =o58G/&7M0}3lu 1$8*8x#)a84mnM>$gw@$ 5#* WԠS]I)7HNp*HNwJ;)ƶb$F-#{ $B1;ooN';Jɳ"2taMxbUZqW֍ߧʣ(q7%j 3VH{F9_DO^iB /b >_⌐=nE[9?R±j ~(*OV,Mv\DD 9PY""Bp1L^ eE;@6uGj#sP{/ ڽPɵ@ҟ?Gbȗ#e #{S+fmV>w#11Pv@&u@j2" {{ %.S |7-l,KvHɎkf/nencO`ӫG{WJ,V_[t<'n[E[Lb*F[KG4Rn ċ MW"dT $?lqnمCÅ=|A'>;6GuR,})m'Y{yeodizM6:t|V9ptԝ^IS^`r\؈n[h֝L$hz?1-[ve-r"?SN5f1r!q2%Dާcd?ҥp}Ve?hfLwWe3ϾH?p8+X:  9#EmD:/Ee¸SMM:VŚ?^ o瓏> -ܦ$Wp}K b=𿷟%K mLaϣ\ -%(FMel_f$ yQGQW-_/2i&c$[΋čXm8~l\sdOM[jx|vxGsDث+wjv!l_B];Ss0s#rtXx&}Go *_OZ_G̟{[č]F>ºy9ZmH ᤷ6Wi DD 9 PY""Bp1L^ eE<@6uFj#sP{3ڽPV2 _cӲmq#౑UfȦ6Ѭ#H{&:(^`;8H Ir~c瑏֧E/A7tRj * x![5Gٻo2~?Ϳ..Nc#|?jц9Jj&=)f7 [v GɭZe5G  ~!hU@8(ZdH\2alx{'=5'ss̱βFb`Iʒ[||C T$bĶWnTeyG(-DccG i/oƲN = bJ? e@õ;Z^XMZI4};)XQ S ɂ)e so,ju$+yƣ1)'=ȑ*gEˁuŔ#Ê;+o:W :GNsψ)?|nHGG\i h~n6{m<29wEj$NdP lp<;w,m5l(j INjbxcQ>HE[b9sٽsq.ף|IKhU\N0xdLW-ediw؉q߅F\3_ڌu|+ zFQBT[y:O]MJ<Bjn͂gsYχdpM6qH vƣ΋DV_vזV ,wS{\['kQDD 9QPY""Bp1L^ eE=@6uEj#sP{8ڽPHɺ8&!vc5T#6O(dyJoQuOtGj:^.w!+‚[jECߢCH0]-uQky"S3mz8X41ZnџSŝFIwꏡ%[YDP|)#Zgn>/H٤gY3dckq;4x)9|歺Fåaܐ/.W!nw0AnQ ڑQ)TTi cM1ΓA?itLO}QQfksH?ҙ9l^As5lۘ{ΝhY XN(v $7@rʱSp,$b.k^9{0e\"&ӼD d`zTKAGi r!)yg?]XǞ{dBuO}(8$ 4X8J}il4٭rJ2xg6qY/6H̴ S|86Btg`pcPI.+ȔJKT5ʱI.0o.IYb{>B.F)%Hl|sV⨊VWx{yii|ǒӖWv-i}p#vǞ&Җs{Sdڼa#Vl ($ߵ+"ѧK%؀Ʈ `gsI hُ3Łc>Ek_(2_gڨS`IϷj o6|4>+-E]$w8QMY\MXq򡒲׾#~@˟Ri#Q)QTޝh[\JÈ&6{yojosuBʣO:K{H n6xP1ߓ7_{.l"yPIoD4Nwr[c`*G F.=XT,DD 9PY""Bp1L^ eE>@6uDj#sP{=ڽPydEUvn21r(eጋ]3Bm69Qa䃃@b͆Q%LWkYPW!7N *Xpi.RjjOMZB㣴P@$iN-Iɭ kHNc#RJȤű[Em)hP7r %ϽD97 W 1'ެ2 #5L+5T$5+ 5~ne=gP!ccϖ]S5RbI|[~70bx9vcWdƦ*QE#fk+ߊЌs>bHI$`<4Ț\inmFs=Zi8B9ʦqFD*ZVE Ô PˡTzDM'ex+| s43L841|L ԡ$j[wT-rжy>cU|ܙ$r0|Y;Xl{GjLEDm$@Tabו 8h+oaC2PkҮ9]^yxTdmHQ{[tUNq;wo6Gͺƅy|\qmwc?aQG;es~ nbu#Ś,7cևUC4|)0oV:o2څ'ԫ7"LU=RrV_{4VI B9y~f>@t6 eϤzJkkBX,-B~́Ͽ4d>8U[kmBz=I>LTV ;u cQ&F` *2hi71M`eHh&o*-:&-0 >A }$56D>ghd [YCF!~OO#e2ʞrz] BK~cC:XE0wmcC쑲Jwr+\:.# W>9mܘ \d:޻x3^_X"d00oo&Y&.H$Q:dHY:}Sj=qghrXko,c)T;8Gz|+q{NFu SX4 :Ku?$. H; T} x4TR@mp]dۜ]%D=*\wip Ywb> {{QǂH"4RIES} ~%:A&\QlV{ynX bSs-SqxI-`v8'A4A\^\I,rQ[Pܗ'G~&EމNe5>G۾<T%wP;TSQuduI|4jt*QlKj,B♾Ÿ}J +KIk)5;hڢ|8Akkmf;?VUŲmIK%a~X>٤tx,pƁ.Kg?\ao:w j$"a5_8`K qGªQDnP %2@& h+vVa$J(9]s -zul "DlKnDD 9ޣPY""Bp1L^ eE@@6uBj#sP{GڽPx<͏֤tElv2"װ#yerq@د'PŹA>}Yr|lea_=* [ 0mHl3m.=VlXG5cjE8 }FM6IE3]q bɶ\Amxg2JBv>~JJt68ڎOnq2w#=kHql1uvEE]BP /c(%C:\r|$u3W{|9IϵRMv&>4w`8k>qy!#9%l/_s9dvPNN->G'Q -!FTQReʒ8T/q;\8j(~U\!)Ivƭ9CTHwn0Oz^BM-JMfOH$ 6;VJM eDcy?SC7nʅCk"i#o )R~4$2~Mݝ|j4NS]J<lgUP.Vrҫ 8>QBn78IPi zyаbŏ<ՕDlITE {&QQVPǺUQ>vWe9RChU?9#ՆB9`ǚe?y&pB;s iCkU7uSvkle0}yJgoz1Hğ3Dm- F*YIY+[IʀqRɴQp[yTl#& Ѕ@6vDw'}*GSy%b}}-zb9CeYKu cw>|id[\ sK5N3c!Si[V鐇RC)>[HMbjw29 1ߚQ] *ZO\IL}-^|O$]6~rC1%s>O&!uܻ21U/E- n)LW${OdVzBu #yd^V,X9"Xmis7mʆp$q\afI^M8$(S+* 8=uDZvr^E4yڿ6q> w9rH/['H-BS#у9,x#{vj-UdXm&*X8* 9UvWm[KęTۤ#DX 9>PY66L^ eBp1E(Q@tsj#Pڽ{LP XX 9ZPY66L^ eBp1E(Q@tsj#Pڽ{LP XD 9PY""Bp1L^ eEA@6uAj#sP{LڽPp(۷Zg?O=`Gq#r#Gn;|Gh:nDAwv`o,gzzT$"BvgtS5i!HNSO`x?\6X;O[%UCQˋ"aMSC T+p34ԮڛIDsˀC/lInǥGb.s۸/vu]uϪuVŲ ĠK>@yqŊSqVkjKga'QsHwiitI]BLI6B1WO>-o5-BnV6>K"i,2Ri.tmsT ųlmC ֭.0^H~M]Ic^VZvc<{a8 d=J%t=Ϫt֝ݢ,p "rs&<0r-i :RdVzU/k,t #%;N/s}pqT]aOi:&ֺuŶh$MB>"s䵍yUGe?c3L kJ ,G+#ԟ}](59lUnb; t1Nk?z@ +Uy:I g6ew`lyd%-C>־1N\ygfPAr!/2<ꜥTc\ro:߬$֭m ٦[R*ft~bRF<4G::><}=fZ0xG>XlfG~{h?':9UzGN^%u{ a1`pJܤλ~Pr]Mo,VXE VUu,}󏠪;{Vt7'[ X(pMWĶl/{J<zzfMnXmtDŽAl3\3O;o_CYgÑO`Ԏ6*YbmEŷN:WȊ6f 1TRRm"4k;su(V2;r$xOXAϮh65"|4wma-ީ`S{CZ XIOJ} \Ev{o\i0ǣX6[A=RI [p33Gʔ'mz\v_V=fY"9_Gf#15{i*dw] :v`o`mqpEŲI,B3E&Qo:Q"eu>aꋋKAW;a]̢jEH=\PmKn$7_j6:P\귱\pf]01w~N{*$iGz>mLu>B[gA9999QRiR+Υ4]NkUҭ4Xs NL@*@nFR^]2$dI ,p?QR7ÍMY̒VStn/UB.w|qd{-JW_oTZa9h7=ѡϧ4EG.Qq`HC ^Hp?OX 9 PY66L^ eBp1E(Q@ssj#Pڽ{TP{XX 96PY66L^ eBp1E(Q@ssj#Pڽ{TP{X 9PYuuBp1L^ eEgf@6rj#sPć/쉏PHTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 16735 Last-Modified: Wed, 30 Nov 2011 13:28:22 GMT Connection: keep-alive ETag: "4ed62f76-415f" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes D 9PY""Bp1L^ eEg@6oj#sPćn쉏PJFIFC     C    @!1A"Qaq2BR#b 3r$Cs)!1"AQa2q#B ?VKBI>!-'v1ki҂ډJTHۅiJ9U@"drj.;1z~ԸvF_BӔ%I# JI: @UiC ex>NGRw 'C-@BtީJmt1c"ivPRZSQ"G# 4iH”BT{BuZZtd/c5t +JT(rEiːpdlӓ򓟱';,*Dr(h 'pPco+%4-`ImJr#I4yEEd+ uj:M8;+o]G6zSP**N#ꪔgpJPe QHc :W26(@!I)'#z- Yid`H,}h^<"RK,aPzޏtG Ug>Q]79ARK@8=zUg3A s%!9<9nI.B =qpRBM H +RF2) $56BNmZd7J~w4< o2"UӀ- J\{;JW)I*O_Ir4žخM C. *;J鄩ԺN[Ȼ2SO(ZA&g$䨷t3 wG$zP y3J "lhq )Lt('v4ۻ9!XvKCV~5AtigmNJKWZm_kjHmsI%4&Os9+(A4ISI(wrŠ-٥@ Tn r$%`TOH(7x! IrM:T '`N(PRЅ8q0*>J;¤dne .Jrع/J[J( C8m##x)l]Ұ~`TM=PI4x?ݺBˉHO{ꛡɰ[!L,x[gh9TN{ҁLqf㾦]1E#OBsQ&ۣf<d8EX*#ҕ}*U hm6~+lTd"h[ ?fe`m^wn@!B!) oj-mi?U[ȑzGnۨ7J+R_5?mqfeYg. \i,,2F?z˖>XT-WN''DD 9PY""Bp1L^ eEi@6oj#sPćF쉏PNS4Tl dɖ0[8y e %$-N2Aؾ$s:B= QpG4 22ǒ%*͞DxdTU+fBUMB̤c2(& %<)솉Bl# ~D0)4 z Pq.χ?iT]I(Rbو!Omz<Eb;j;-(IJm=;R*RWr$=fyVW30TAw"qdHYQQO=wdYPOHj'7)V>KdTSF"dΜh]:#.îkrњ6JbGJm  !IV}byA*(S)llډ-~c ;W J+gxqjm8>[3?-#*O½_35)3p4WʯC'sX9pO٥$_`MſilV7R?Td{#Vse(<QIm tjۯkt 4d\Q0.\O);zd8р*)簥uDjy,(w,~ Ɵ958);5cXpHҘ9%bs$X ĚطDѬ[+@_0M%@/ lxm>qHSqI֫dX5#&If$H+zC$Im!s^o%M@^ZzJH[Irv96{qkZTrJOd)W6(b88 }%@UNB\X?B*"&N-;f.';U)JұCiBJV|lвGQBT}bC'OS JF7 CR[RJP+;ǎΓW.oZJITgҤ)}-qdnm]N|K0ɡԫ Q)Sq=ǑpҎ[Ǐ6 Il< W5,_$'5 \HMȠ@!CqD9 FdQg/d/jR:^[scK3+sBBTҾSYT5sevŗc VlM8Z"DGObҽ)-dͮ# I5,|De#%:R)g-4qTT;v3[y?g!'i2΅1GYAmފlΖ 1",eQ)Ѓ9jFUŹ>{M Jүb<$jSO-s$殨خ^fv<+.ҥ}Vly>M?@^jA}H)qg"ѕ<2D1bPB؄Ot/H5sCVj˶ɻ^fqW;_VTz>ĨKj;n"%&m )5mz@iуv JVTq<ֆJĿ gwзx;D’vՐԥC."[]Jc[{JITu1_o}Iֲ- z^_P\ l[KJҥ%X2?ږj@Oe t"%CRTlUi![ z{i;"'۵"NGa=;aʷ8瘞f}+Edx4y>|NO ڼ1$ncJoB(Kě+N0m?Zx'#6/fTSI (Z==[*Y'Ҥ=̈YP`36#+룕IV3WqR[{B1SU-m$ת[XK-٥}B P*>j0]X5xr r_c唧-CٕyIjluɔ!)wiA[d-^,NhrN-$(>OzJZH|1Et]>PD bRS9kitRN4eLs>',JcROT2BQ|ƚq- RB~TBRK C8L{wKL˅W69b\taŢG3g [a_ej%+)#`RdW [dR*T q%G_)4"YؔDD 9PY""Bp1L^ eEl@6oj#sPć 쉏P;"} p;6ޱ5J_Ï,g "rp-mg<o?lNYx]_%9‚*˖!\oj9VGgwBvۥsD=-EAl[fRmp,[XVLweROl*#63-:n2]y+zAK?*IYw+46KidzCTAҟcqi {{W{nAU{7y߲kfaYha^_UdJÎ]:*ȣHd1JǧbŤj8e[s >ǞRҴRs1K{bmt6E7n\c77-!iv.g ,ė"cP>J re\SvemaZfb3AIP#/"iMy!d9 1NqR}ӏr5y@ɤIM>5&/TI#=8b~Q0dRȓ^_NYȱ. RA|k/Tȥ ^1O*)'滰nRTw [$IذpVFZ!rVZ\ū奼t o4\䔣0Aʐq#OVT-\C=cmߐgSA |%I!xǿz롍,JIls)qJϏ}q]LΌ$})!7JJ $dgj;'&#2!ABhfY>@dҕ' *=DlNyҕU -K7ou$iP+zG:=\i sމ!f8ZC&m0Uu)qËUJT$Clc}JQ=_ɇtGq_͟$if-s[Q_l5_&~GF)Su-S$2S+['.GVRӡ d $*T)DX 9kPY66L^ eBp1E(Q@qsj#P쉏P5XX 9PY66L^ eBp1E(Q@qsj#P쉏P5XD 9hPY""Bp1L^ eEm@6oj#sPć쉏P6=JIDZŋj$&(UAoC ,VN(3HN6'4zf[: 6eGR:н35^cScʱx8Ο>s?/할}koAPM7:zsO[_~ڥ_jdʘIJll*vVF$M!R#AV5;^&(c~u>a蒷#6 1Y}=qߜʿҬ(힕g)ڎ8kPuG_GGgҐI4ujt! -|Gp*rգamHA%+G\,Y4YTYO|lC)%v8J҄~ZzbiHRyʱ@'ɂ3_Ä{#GTW nUg>Ց{%8=ܞmO.IJřoFeO6_p?+S؇;em\dGGDv y\J~&6#\te%86& TN~E.L3"diM.EQ$cc#<}m3S? -DCDw;cķe"29K.O; DD 9PY""Bp1L^ eEn@6oj#sPć쉏P" qIS1 ͎cO938o;h!1) |bڠڴ6 )S7fٸ-J *2aSVBi$A)JGV.\/EeR!/VHK)GO# -Q%а9 D<;cJj#AzѦ Dj_(E6hzP R  ]xkC] l{%-[mEzF͡,Q{\dOOޥ~kՋ.#1e\łYFI>*ě˗+Ē!RJZi>OAZhUϻ)J>rh/ pS Zz[93M`,S/ ޔ͞'# Z: ;tsҢ:=X%S} $b1rO娫$j:_4ܥlxRI>ms(ZtSI[Z;ޜ-Qdᴂ UhDh.B=@zb۲^=($yX;L$H1.IZT: Iâ.9ny~pR<ALTӨJX$d+5ᯑeHVjlZJP7R(ihbv ǚZ!*'ha&!:mW>.d`P\k>)O ^䩘1hK-9BRSçJlU~9gHO՞yI 9 tֆ+e15|䩒eMzLTTQQj*0bEи!XQ'8nU+:~^N4B$d(Y1%M ${жBFs@ɍ1@4Q񄕹V\-C:dyal;)ϓ*WH~%[6^ebi #p~kdV84P.7p1/N>r)fe}ymIR Jֺ(3\9!dw8IX/CNՒqK9& 9 Hb`IB ,$lz%~UtaI@cX2dqb26q;gd5/- b8w ) \IJ t֤reGa^>ԉ$vwv|֡rDARRO|(7-GqY$ڬ~H 9+o9"\UDD 9PY""Bp1L^ eEo@6oj#sPć!쉏P.StvBXGTt}eMFUUeTdVltl}n)G+Pƕ) H[>қ&9ږ5Ͳ~=)2gQr&XBqg JFI4l$G8JDVN^AIzնmQ^1KWʺ uFO2Ig27׋旟#cLJ,+Xy%hPRO|Ī acݝ/RI+ +RB\' 'Y+J&F #r($X(~Rblm=³rA%$q*JMe,`ӌV)^S`H޹TJ|v-Ho_4mB;a-#WCXL-ce6iv[r$- ⱚq{-)r<`Yc!,$_?+bf|7VU4&%yZHJwg|H$.c|}G9 KO.O*-RfFȕαSriMKFO@AMʘGBOjK$A,3sGAKdîl 2e9;>l hIZ|V|G&1\#ny9OC͈Imyj~NK*;?ҽ<5y՗3bbݠLW I>4m4uk^,qQ|[qunSh]ܬٟ-I)'д?VT~B{SĢF8 s tS6M[[)9ڭDT4pqEi46*BP8V$zثCLJ.$lPڹdAP( ڲr)PIP[B A NG8+&x9]oqzlBwL-+;L)I*d) JA j>(7I*P ҕ"\}`9F R"B8q9D ozDMzgGJO\_Jjj% 'ԬnVarui^LxSPsEh>!u.HYX9je^G+;>0-b)Ԅ)k2[hyʍFqgۯVW DD 9_PY""Bp1L^ eEp@6oj#sPć&쉏P?_@N1V=d,U]'a%C6Ū1>'Uc"D#τm+mCLf҅0~N| W(b$&H)*OY9y[ c ӫleinDnCJ6ɠ'`+rZɌnl wLrs` ^Pp´Qj[U1{w*BOUyC@[Q)pNRTBu4ǭpO]z\Ԍ.4򒲯ޒӱ:6reOmI`n)__8+/NR Ci HJ5[wa>m?de ]cP_?Mg0T ar(n˙){'!-R?o#,(ao8lTGnP\hZt~֌P#//WUN'BРS1%nzhPz"w-ڬ% 2㨺0s5S)N m&ʊSu*z#'lgoZf%H*оmAV*AUʴb[Ƹb  wGSX%2VL苋B]8⪓z,²;oU[|wKlbT{䥶.G)&5t 9_CқI?u2 σn> l!qÄϰ.*+gX Ǐ VۙujU mVdR9M2y|Q+'|z9I͌Qbio )1[=O!5ٝ0<!;G@^͕[)aj+ V[KÇ/uGgVD_ K !Z_OJտ͑A Jh3 Ȭgf>RH  }9Xm5ң8Ea;%/+4]oΤ-/{D՘#$f}A5rR/{ע537{DYO@oA֏?('IHtAj~kvP_.PSS+ηNN(')t J;yl_+쮗wT(]2L yKY U,V-9"C}N/'Uf$2-3,&^SISN69tO.[dz/}"81g >-]ꘆmldŴJ[hoz#ǡZP]Z^cz뚬a)lW9LJ`% \uػ˿(b&2uZBU宵{چeŕĻsKj!'R{XR-ψgx]tO S[nG.Rzp>k:J[-?nWKPC(sc.qN ":e@hJ>5N\Ah!!*cUX[fTHjK ޝ2&N%SXN7xFuל]V\i6ZqAZJRH:W{cI>&:4t,6!ڒz`͂HX6NEԮVC̺֘T\tP<ņ*~V 1/6ۻJf$e(>_2Hۨ$G;/:@>㎥DX 9PY66L^ eBp1E(Q@psj#P쉏0PՙXX 97PY66L^ eBp1E(Q@psj#P쉏0PՙXD 9xPY""Bp1L^ eEr@6oj#sPć0쉏P̷N}5e[sW QJ <6ej$*}puinW,o-MvI!¦|Ρvqvt.;ȀzdcMg q]e ΆBrNF hSkK[E W֊z)E=E%Dgު|@y [ŵ YqO>KISHf'168S=j&׸UIjtJZ=ǽ fVT@\Mhp(a`):/d8B-mLJ#oX8?jd4W_w1!#YI?r#EjFWcmAY5FlTz4wv3*Mr O p_,JQ&2l4 -8w [uq, zwo ]-c'6_I'TMڡQOKn_e܅)q`|h}1?[vo-=D1e8'7e1n<֣??֔0q~)Ѱ$7(xu\qJp28yԊƜBg"qĻٷ"1af S!#Fߥo`}ɲLwUjNt80Pn7ȫTboP]-n(Ef坱BC *5YF(q*OD Y41Yo((m{6^@p_$c;a5\ ( 1*e@JA5irJ#ԒF(- P9]d+S;'.-KD9UJh 6zlcE+y%;`w|Q,3  ܏U.Ts r0֌ KljؘDt 64\H a;OJaYH rwl>/èj + ')UZh-d- w8l}[r#{NnbE [BWr@zTS]<^wߩJj1ZV {W1AzQB3:$'/CWN WOt5|6w+${D 9PYuuBp1L^ eEgR@6j#sPVl[P"HTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:19:40 GMT Content-Type: image/jpeg Content-Length: 16839 Last-Modified: Thu, 05 Mar 2015 07:54:00 GMT Connection: keep-alive ETag: "54f80b98-41c7" Expires: Mon, 31 Oct 2016 02:19:40 GMT Cache-Control: max-age=7776000 Accept-Ranges: bytes D 9CPY""Bp1L^ eES@6.j#sPV[P~JFIFC  !"$"$C F!1AQ"aq2#BR$3bCc%r4E5!1AQ"aq#23RBr ?UBN2}Oހd?z~>A~>A~' S>A~'02}Oހd?z S>A~>A~>@2}Oހ$"PbI)q8Cm*?JIAfO$=i<=TR-xڰy엠kN( f("@h_ծCdKXfF}ܑR~2xl(Fz RE)HD6H ym˚zPv-JB#n9WVI ]s[N)R$AlVLO{-=29 *# edaOE~]CB4 UcZ^tXgrG?}liM+# 54QXuԒz`ȇPI ''8>ڱx 7;}3?6'?V>}/Cs9Pc䔂TA8<|VQm#Н9~PIx%?<zϫ˗Վ%dpC]dQuʹܡ6˄ AEi2HCS!.ub:Zݒ}L$DD 9PY""Bp1L^ eET@6-j#sPV[P߳!Y[(j>d[Ia>OXZH [mr?)K[7 RQ>i?*j;r94ؒ|<*`d-[>PqR U 82Ilz:.wƎ)Ż6vjJ93dmxlzUNLsC H m Nqe:l:nv1e 6O-F8qsש:5H݆Hz*[jo~_UR˶8J{q۶]] m$D*(Һܺb(>t 愊@(0鶔jq=wЛMvB =2 w[2 .IJPm,2ŢƄx?,!ۓ7 v_$-[ۺqnYZY7>dpՓ@tXkoNʌbqa(+ $Jsv<w>TL%CC/V/cxxg?1ڋLZË-r`6>>~$ Z6.pTb4O >Љ.m#eI ؗry'<1Bnr+kJ S+o A$y@f`3[K^%" sm*XwqJ 8@<ޜC`Ss}*;%,BR%nʲr7>wzV55L]\@cTR ʲNt^C)VIKW''&P J풯l2 >yNx$sBN(Hw:sBEm4}#4 | `#q]U/q4!!;c@}2Ud|wxm7;}|w‚dv;EϵI}܅nP\M"P|@= P @(zHl6xa2!QDD 9PY""Bp1L^ eEU@6,j#sPV[P\M$jRlnzmZԑ0b\^IEwx1sKe4'{*N68%Jp,' fIe"ݲ"b 3WɕJ[`ʪ!R.VPc)VHܪȆOX+R$q' {V!.K4Z+reIV1P ;"P @(e6,Fcrԣ6Q<Y(<" cFhtEi dlV!JK,;^,*4:$g+d}*-?W'BϡQLuD&K0dPIU.*l)VXnŸ뤬 #f9sQ\һ]fƓ*ޫbS&8,yriPy]JJNNȬ7^VP,N}q^w]'%z= ^y/Z?oe9f|*Om5=x[l[]:IuHm#%+Hk^m]tC]o>A8]RG]mRP|@= P %aH؂PH98`(YF;. eZϷŚhVʷp_vťr|"YS.!Ħv0=%)>GӖeEyTfem P?Aޏs,ni"zru$TxZ%7 C`BSO,^M] wMK BQAiO(T{wϵɹZ\mJjKvRN~M/oC4M\\ kJoK^oB]IPJF|>'r텠."LYlG%hqXIs%"CD|'_,FLT OT?(ՍNQMn2G:g-9DD 9PY""Bp1L^ eEV@6+j#sPVo[P}nbu/0%e)#G ͟z8kry{.͒[kXoJQs ^DTsUoU8u3%)nz KsrYA’kzۗ'jSbĒ-{6[*d#=euuvk̥ۧBCel.pNHuܖ%^KH#PQ宆4y3Pw:sBEAI^#ʷ6mTyM8)b<\z KJʷ<% GU|=yh}SY5WK(l'y@'$;dFBf$OUSRc^5G-,8WA_PáG,P@q4$P > z%l:բRC"LRӪ(Ȁ|ҥ qmfJdTK %kq<85/L|EzG2BkiAm!P<>U ǹS&)۩e!$(8vs&A9u2]U7{Kp1gp─A7<\Ա +[rc.zUq?RVC.(8FvBI:ҴR-Z^! cdsk0W`8ӄgӱՍ.φueEFFꘖ␦׽ Q7nwn:DX 9lPY66L^ eBp1E(Q@osj#P[V[PZXX 9PY66L^ eBp1E(Q@osj#P[V[PZXD 9PY""Bp1L^ eEs@6oj#sPć5~쉏PA6 Α%iH |_jPy]ԷEw>ԇ#Jj E:nTg_dK9ҕg=N >QA9qȝ-^i, le@u=pHÆuU֘.3 ^5(j0sqG`PI 5v:j?p#e PE9۵ DPSnֻL(1p2'<%8=b\]ޮ|釭k*SqJ$)Y FrU% eivtG2$.l:BJՁr6Y,4NiK.l42lrb[hR 7Q^utv|]"8\maPgF[^yH%Ohx,HwqMF<R2e?]Y ,gՌ]#QR%[N823B 5}n^p}b &]l JJyz=_ȴ.dA1QJ@R6Fڣ#׋pcE{XjyrZZj zv>q@u+w l+-g}N'c{я뽪 d8a]sBs;Uz1Љc i+)peȌuĥ88'5gflW # Jr2 5b9! x7سČ'BTݷ-Ib^ßa˷\,M`1Њ˒/* "-9o z|GE㧯pp\AԼHXJrF4Vٸ-ݤ뫈zK2T VV9N=#'p0i1d*%#:ɑ-R=8  PHcxҚ2.L8^GZR:Dak; 2b!`%HH=sPI틊uS̖TӋ2UFqtif/6- \a!򵁄BXt60 vNi۟}9)V~.Jiz/Oj i{T8w $n^e莥I![(߶#Zqz]\i+Od_ JJ%8!'P&1>g`=4y2 YA+_t$(TKGpXk(4I8pAK$V w'+NGPykqBxҁ vW- pr5|~{~4D 9PYBp1L^ eEt@6rj#sPć:j쉏P̙̌78"2%!ZpHX q=MBCI|Bs^!^WEڣǒO[R$|S4&qWjKCًܯ),%) $L8ZHW*5z<؋1Q''z|#s55.Si1t(g8;l}[VպuqGe+Aʄc Vl@d|fճX 9MPY66L^ eBp1E(Q@nsj#P쉏;P^XX 9ePY66L^ eBp1E(Q@nsj#P쉏;P^XD 9PY""Bp1L^ eEW@6*j#sPV[[P&G3A8T$ 6P'p'b+p>vR+jG2sVHwhxȆ7>YNYQ ׵,|z _U{z~\RTH[nZq>8ܧMNO5JatFy>ΩiwX:yqq+nTSj7gjqܲL}vKVZiH0 ՒF@FݙEngέ &`*n\g΃b)bKJ׵#NV)KVG8V  ''ťc ~U \HCC|8d|3joQZ ^m&2Kns'/5:.dyyYu:,;WnIt6>}ǯ?GflUp̕kBhHSK[r4[.{#Ϝ$ =H6֨o,j.++/2K)!NcG´؜ln]8΋#uM2uQ.(zCD!2iH½|ԣu+Myմ nc{+)P<=A؊sTYbwZM 땹Saґ@d|#ww8ė-qWz^策5#<֝ .>v$+62?؎Leuz{^ԧVc,Z.n9"]\+dh>[JT=2=A U]-*K]j#v6E %smKkv_s9ң 0qJG*_G'"n-L-e؈ 6̗='JMf,'C^Ŋm[ӞӍR;URuI&vxSp8l\Aǟף&UN.o &B,*"III>\3JVJ]#V>{Y6gj*(()6iAG##QSM6n1E?m L,)v+ZBW̡I5bhHЀ{(./ÝMDD 9PY""Bp1L^ eEX@6)j#sPVG[Pz֓SUkԽSjJv8 g*9Iquz=tlr'_Ih]6JrFR;'$x28gcO/-~D#\u>yRu47tǘ,-E Cm$cO& Vܙ]k~6e*qK{+^sMgr`׸g/ֺV1u)2Qaʎxk~N-7UUںzMb챤Irw$JyJh g9NHYѧ֪ )uu3Eg/,bY`^Q?򤺹0Ky%`ݔ=GmKBFVVkLW%>yT {=KCsmJ}nDD 9PY""Bp1L^ eEY@6(j#sPV3[P[4Da C\W'Uc='WVb:pS,ї6WS$}ٵ NS/hdjVCJT?OީooᏓE%\(NCE7ߡ缕I3SbZƝ6%giOJq'쇾潎-GӵBϸ FY9,w PGtTw"Gjhڴj$O+ow:sBE4 %.tŷ@@f[?Φo c%,+NS<^LpRLnoH(7je_1(pzs,X_"BI1(l# d* җsp!ROTRy0mXMl͏U1jHu2Ĭ@~^c(3T&ђNC?2i^cj"U–VyV3Lo,48pk{[;`wȤ+%;GSvR<'*F[ݬtoVtHx:rTBrrғ. {QlmYseJ,Jv3\ij"-3";lFC/+nQl8 rnXKz}?#KV`ȰX6GUBx;~R߫f#K\zL<%Ƹ4'W,[R/6hJS=Ǵ)'RmVx2P): Vh]z(ZzCA yd~B&rC(:i{ N !Q *l ^º4Y>kk~FYAVN3mjݯ1F!Z΄Б@ ?C jgJ< -(|,d)HXRBY$;unl y.)TT{[Wu%6IZmҕ+Gߩfƶ! q ? ;&44IWy\mQ6&dOynO95q,^k_V{{gy#aB2 )F} ĦٳskDvK)eoBҴhJ_ s9c0ڢ&k[V>3@Kmv{*kSuBYhFۚOgjYQQNDD 9@PY""Bp1L^ eEZ@6'j#sPV[P TOr?Idσm1%jwc,`~gs3uQht=s2˛=Km@gi8<W5؟^jj&=v2򔄠`j.3}Vdusb8HZ,҂q1G6+t P|@= Χ\m>"[q<%8Ljy&y"k2sHppNNj$hu\"a~aeڛw8;JH˂SKO*nIT[JTr ]Of[V֡K "GR\)/Auꓜ!Y g* e J]d<j6}v2~b]6GԎs2nd1ٔ)l$D01k*8Vj&:ʹTQ:9$R[N$q+ k<)n}:NI*Q;Gw yo+oJH)WF< Cع4K}H=hZl6FfԽߔ895[Ul)JSxFڣ+ؒΖ߮1w'DfmVc>"Pތ{ڥ'<'VYuI&}ԏ;މ}QܥAl>ꮬ5UK9*f.xvUbRRشjW:I\nO+JK.r#D4ࢵWp+VWSOcS6z4ܕ+ovv :JTTPQB팊[*䉾1C-ܐyc\ST^a8a5Wۦs#\Y H scRʫi WKȲ5΄Б@( DK;2[i "{c5h~$ݦ4 mP#8w5R6:3coK%?0n*y}È7a]%#jyUݺ*MaX= O)j1m AWc%$m;Ve%N~~,[UЈL11][DI;FG['s F>"5ŌCPv%`px$rQ\.N悺n<> ޚڭLj#,L&!i'O$IwM M`%==ފ)פȋ%DyoX{=^JI*u:]2{c@kKOBӱtA63qZ$WRGrYPVyq6d8ϊ"$ ڹ\)(8ܷ.0NK= k]Iixbj*m`%A fn5%G1V=x,xXGzY;)L*{]~tB-];d#)FlI-Nidۧ-&gcФ4"ViB$/^C;,'aΧKA(n[ғq//?P;Qh%%,{ZJ/{3l~PI9?ٸrǽ4QPJ=xg$}Yɩ@bh!-XRrw8&i}/BYBEiˍ0x RJO}F<*Cbo) A2ŪBާ"Jwxa1'jrGl#%52pr5Yt>p ׫ivN9P%!ciY=))9YEC$Zݥe!8ȭc[g!ۛFA\1ġ2MJKuO;&p@Zi塴$pP08\N[Ru'0Qy%[O=LG1XfJa!ĞPAr=;圛T1.I.Qv}Vu1%f)%MMaT ~W 7UφR2DD 9PY""Bp1L^ eE]@6$j#sPV[P{A 3jޙ\<3|a)8&uyJ~deЕےk[S8wFƣͲãAŶD3Lwp0yRԤLI(e:= u끽)%Ц ZgvAaڶjS ݒշtEZC^ؔSqRr v⹒|&KǶӐ-1Z ޠ;ҼֺꮔoU%EՎFjS̭nZN'= t[qcv1.@΃OG}r JT wS5G%2΅."*(Oܐr^R`Txg89#W-z(9Ѧ^\e{wr2O?Z\<(**8 ڞRZԓجr~ure,g;"P @H<T5Sk&Z-ɩ Hr2RyIUorh0RJ|aӷlZ+Qaj+a@1jmSNqbӔ%)7y:durXh^믠Gb@;PU7K-ʯĬ QzϨڣTlgQ2CM')ǽv9j'7$C5(H$ (HBhHP @(β̺ϪTEOly2p6:=.Gc>z|iI28@8q颺`ת[ǘz2$d˜0!CRxOq[,g$t]'ed%YJ!vu}LQ$IֲFOj@(P ;"P @(@wC'4@JBm1U-`$P @(P|@= P @(%yZLҦ~,.g!H|q]DpC{ch:5T8-^ !P% )$Wlg&kby~UVE=zIsb̗V#!)H'W?e\%5Ӝ{FRX!{ZY\ڭm:6&@VҦ?X7$e*cȜuh̠R_nxO_0֚ DViHZasz )!8b*-M%.V2d2>TWk~bs[-LȭirGT7j)]=WpUV|Ej˫xmò  _G9jtTAݏbnIc.6#0++4/K-xtk~U9'WTpG5 树@(Ѐ{()SXZXZRIq J 0hHIP.ON{Vw} Ym-,VJr[aZ㤄V"6e7ԗ3 ֲZDvJ76$甞1eI-\7|-$$kUO)/rp9mD$ 9PYBp1L^ eE`@6Bj#sPV٧[Pd)ť`)HXvzEBhHP @>t ҽ]at3Ţg6\(v_r8>~y_Fu*0dg?\k@΄, d'Z(z~ev\4d3x,G6<"ʻx8U w| 1P-*sEʉ⾇X~9;Tqq}9l_~%}; \B4X',K 6.7NIRXQK%?~^\DSm{qo5f'ql)l̡wWq*Re:6ciVۖ-!.W* T譪ͼ~wqhL3(w:$D 9_QY""Bp1L^ eEd@6j#sPz&PN3Uec3'pNԎX"KMB=H\/c(6A~M3m={o-yc~"Mz;XNA,G$9ӈ+QAnC ퟟW77sQm4s*EiCم;qGNF|}fx'/0@8'^(.x6Y;ozzE{56eip֗ [K'>v5dg?tz|^y-V晗GkF(ګWЉkVܝwgbkQR"+o(.[ft\`~&ceRԠ'M6,u+{(5gW28Itqi-Qh֎/eHQc,1%"#:qZ M N.>[cb^-ok-F[%JjB641`H!8_j Ao%!ym];";N|sن {0y{T_1yZJM+~Y8(fPoVN*Uvs2D+w/ ƒpAwȶ́TJWz|iתyk7ZX Aoq=Z)j̚Ǧ H7A` #zNYj#̈́OW&/Ze HoOۦ {_mBI130V f>U1+3YybjiקlLAuDdE;f_ə\ NȜ`O-Re" $M4ishbi]zt{eyQ$V1yCӮ˾F7$0]0/b杁{t .oGrw RN yPXr=]$,V,}@Ee;}0 BQ;/|{yG͜7ZN *P": @*b⸓6R#7o<"m 1zjŸr,vo^(lJz)#|7V$M O{d%eo-DD 9QY""Bp1L^ eEf@6j#sPz&PӋ$^h%6NB !,+Q ;Q5'4M w ֦#SOP'̼y- Y]B-W]Ϲ'8EgG[>pv l9拐X2hn. *X<2`YfN5~d>Zf?kzqmޠ-of*\c*HF̹c#@~? d Sq/,itw%-4U4*),4ߑ@__rCv]Ys\ǥ^Ohu4$ )N\@i Y ~VtjDZFmiVCI_ehx*/lvo1OS'pB?5oo0j-Rex*O$hͧnw<-cXZ7ab,:1EO%lÏ/O5yH~DrgE-*emy;}o>gH%$FWR@؊so4rJ<ɆXRgkycōSŕrZMD"wMcn`żw3!*|Ko- qJb8:HFQ#e4N-zGmsq`umX-$_S aBI 10U@;M(qs!6<+'M-9#h#*ꌼE]>M br;GUCcCXDNSEWo ƭw7v3]Z9[[3i`.xlMerha+ذ:#&As2'R>??ο̽^oK[K/\X:\V*F sS+UX`hotZ}4?H'5 #H|M~Y{VQA |> ?z̤=K!b);UYH?MXk?kd4'ѿ VcEմ˖˄4^n+|dL GfzŤHD[-MJ2Y6@f'jK:vg@[KNҾuV 4bOMj_~r ɬe-?(!LrK Sŝen{SQ#h,>Z c3[WHYQ|j4jdd*{<8F#y FN.nhb ȨPHF%ɥv149e2L˧OXh=FUKt m EBEQzQZPs#(GhO?9q-A$-j+J|f)yR^$HhJiZeqY=ET: \uVґܕe)⡩/<@59lVyd=HnգW2rGc7fIe4>i{{ۛk 0d&*,rbT85ڙѾ^Huvim$IE. jpٕͨHSY$3Hw,rIAGR[CҴIKͳ(ko*>mCMvSLǑ|v on,'>%h2]ey>%ǫ(dyYW V8Tumzw~C ɬ^dX&$ ƻdNοkuR3]LR_^h6[FvTH(@}9Hhp>_Շ瞵{%gd.yT F!#9o'F{ߤ>9L?(~v~fy|?]y{C!4zG;~!GjDD 9>QY""Bp1L^ eEh@6j#sPz|&P`x1@/WKtO7y E@Hk@Ԁ ɖcܺ|q#_}F8Et1ubs4E F^_X[̷K?2hQ6wCo`B̜`*2=98?c+_:yZǗ]4GHr #FU< WRT ͦ夏>SH5r㜾G"75X]ZW?Oam&vr5d joLfi=wsͽ<~ooDa$dVu:0^os<+}FL؋p R[3В7o48"E팂YD?XYu)XTsh@vwyYuR#heB*FA |[Aǟ5cXFUgE,7 Av܃#ϛukimn{M:%vq6Ȱ P\vˋkqy?A\hZPeu;",79^55($90}<n5Uvr 6b/Rn'Kb=hWV}1$͆_jTi=d$w>(B&@)IlOSƻ4-]nut{,ةqvyM+^qny}Wyϭ .c͚Xׯ5 FB6`~.S4~fCA L;K|}3O+emN}kE*RG¹2Cqm9]kRi-+hfY!w(fPx#ٛHD3D%ouHbe6XTPSpQ122lfJ54S)b|"B׈~LBCuq 9rp9o0~N !yGtQ%-MCתtV\Hze:N=4BK~Y[}s'nK{xNiRz.W-.'+7lDHylQ|cӵ/-Ks~ݭm^J,} us?=6 HrW6ZI-*Kz@l'eCSDD 9QY""Bp1L^ eEj@6j#sPzT&Pa^~{yv+_4X-;̱ZT)+W=TqYc9~bCi{o1iQ׳c%i" P*Bc*ۗՌywR/yg'QdbS!ESNUU P70 SKR,`IcɑL+r%K#+{`]X=d,qz{W',Ẅ́u'fKzR7)o{R=Ҵژ7l9sلh_]z%ϭ뷐Z2̖,)g14fPjO?+?#&^\][yYfhmVjNt4`jb#suvL8$o3eh)ߗW-_R)..>5j 0 ,Rj;|O _j<`_|{jqi֤lzM)xDJ6t" l+^Lɞa״B/;6=ƇAw001e%J,>Hvo:dyɾdIrg_U$"UOMN -&#HK(cvWcnԨ}-JFGbǮd^}@{Akk1wo_UtͿ)Um{`0fcj7'/ r?'. >cQd|iRAkFǽ&Ǔ4_/+[iT}#S$j"~×˳ ćAkrGOYP5#ǝy (U6<ե*wKͥ"cד;{=Gqr %ݯ&v  DD 9֡QY""Bp1L^ eEk@6j#sPz@&P1| 9ugIkbQY9-O@ +=eaZTM05 eP}t~ @IcqT}=B$fmL$I3%4OtN^lVK.7miw"M} hҡ4vJP'>`y금B bD5`*rU9% izR3'-h[ }&݊e~`&m [EKK`pg-P%HPEQj}S1s4ڏ~etcPHkN*pj)]禆@~bP7Ao4rit3[iv%u-:r!'a((Vi\2[,ou&ê~WVYu/&]}V>]K5 O*l;V@TCBk:F))#2aOiǃϜXnm@ZqK拭bԴ y32Zx"r4_Z~YQy7+{FF뚜ݚ9g7ǔTW/?4[jzEQDD 9 QY""Bp1L^ eEl@6j#sPz,&PLGm=Wn7up .lv<[c[MBUխœР%  O*d(r.f3'amݵu 6.$oy-~@;i١1cO֥H7\jJ*w!RF,d>ئFm./n+[ե2K!*nXh&Om|zV~Qe0$P= @N"` ^TZY}9U{fX%`]VW YkF*h{e:u܍$q_~v>k5Ǖ >g׼æ>cap#}NWyqnʭh4,%Rr;nNl5q6ߕ_fkK3P5Kđc(v P;Y|GX>Ykm .2<,¬T#:(ZEW0ÿ,(77-󭕟Ɔ"Ҧky%=3XDR[,̡by2GTK:j?C7瞳[yFk2jWd-FEܩ{dl~[>uW&~.:E.j{s0jł(zoO'0@MǙo)ֶvtY[WP$CCC‹$2DJ&$lCl2s0_!yEMZ^ k_i#c hgrNjy}>[VHބ +Ucx$\eXDg(1Kݓb~c28&]wY Hƕҹ aaɋ{Ǒ? lloYanvS522Nj*B?rJզ֮$Zx, 4j@G*74;2qxw8GLOkϧiOFeVζ=^ܐ>U@(u\ǎlS>eA7l|5?Ë CAIӨ߫%Ap`*=˱Ɣ`=2K|?.X^"'8Ҡv+͚9|b<4 9̾uVAg6$R(ШjQS\` 8[3ۇzDD 9QY""Bp1L^ eEm@6j#sPz &P4yq-Io;i[:/23QK8 1̐A]i[ZȖlkyNPH#JFdYPUN`AB'Q%f>]F0c6CeyRҼe-QƧ# 9eCm>򮬗A͓ %(jVSe`ЂJu!M0m矚_({kywm|4,_[._ ks8 ZUA ;c(&Yxy>̚'u?/#jiWu[oPTJ Vf58 _,טg^Li"[Z.{x/;?cEmd_R/ K|j@o-Bga>k2< !g_*1=l5<q?r\Wп=t,*ix/X:za["I u,9(5Æ6s:>\qr^?'i9SOƿ}gMP[ VHLE+_}ZA30ϩ&|ݮjf׿5wYUo5iidw$ q/[uM DO,i\iT567bF ^jvPp"?-%ŷ䆑 j]uuE\ޖKxo2Td`5{]VQWvIf不D5lK$8s3Y q0h=qcJKG$YIƶ.0ǧRVHňb(Qϔ"DN϶Lhr(j?#Ͼqw<tz\{(R`i"#D@+\QW+4_8~]y~Owy~dS١IRG bE*dA.\0G48kȼOI5˫--PUק'jWqj_ H=ap(xum#|hɤ-Hk|zzy>Ooa ?b'އ K}N]B8<:|~fdU$wåu0u{O_rq^\wOv uk(,|$ݐ9bQe ܃rRssZQtGRZY)s@zfZ\u8N)41J`p&'N<8Kpלq(TH3c/" ޽kSᔹ rI)X l^(1Z@S&5d~Tҿ.43L.m*m4&7ie1ꬥjx"ņkC1Ő?k7󕿑]ӬvO F[ؗDcDUb Ry~3>=Kb8_Zy~adMo\~?{VIi4wpvf ~1 ͥ?(tI,<2iupRߘVuZ2PB¯#qM2<*?+SݦmPhט'hVt6lnA=ŽȒb"/.-<'i'(\jI `G|xP]6*z럗>c͗PO曽cXFЬ#nD(Dt 5)mmcڹb:M%aw<  T* ?O1RjV>\Я.&d[}8j1ĊUUCbN彰2'` pϾ~nU|]ODbR(8+[pEO\|Q9 ?m#Y|yvHBeYUTN_T0<9GQ'}v| <\7.fԵ{ B<̑ 3Q p}ϩ{1]djo"׬%ѯA>& ql~!1vxg^[-ŕDD 9 QY""Bp1L^ eEo@6j#sPz&P~l֡\![4XcjZ JrBr!`K ={cl =DR>%ޟ]ysKkڴ s\Fhʹ8s>Djwip/tIt&i),QRr\9tXҟͦ^\_+zKG0ZI>M MK/4IY%52$O'js#GȗZOד&V{m kҜ#DTnmKˏ0?1yO?FԛK,nmyi,QO4'i#FBgQ}Q9Ea- B4c_:XGiuQ_е-0Zw>a"zrCqw\I-K# E_/1\~fsϖ_ߘXZi alcqFIྉVZ|C 1z%F:>v|<5ĖyFPJ+Б^`N0/珘;⨪$dSE%ה1i'L놐?:WW//ο~e@L4:h"B*ÂȾʰKK_ku J#[X={mn{oO?Po2^yNŷӺ}zlv6TDnƥ*&Gq/2'D?ϒ4EG[:0S5qA³wH1N.?9N|%<^!,@3!!; e('G׼ǧoelGFG'aa^擴tfb0\>jh"kŮBy, [Xc5w/Ⱥ_n;v:BB%gb鮖W"hL>d )e&c< 휕AOrnYDo]aՙ6$lC.:W%bhT'XG4uY@Ѐk6iSH7svEQҽ~x@ىm;dROI;DD 9>QY""Bp1L^ eEp@6j#sPz&P3'%Lx8XS[yRϨ٥Bix|&9-9?4kySMF-JDӭ7 2PҊ0w21CsOѢ7zUŨ1ZO2#Ee!kE*S&"Γ?@Ӽu OE{M3J0Ryk/4;d9ד-UQC3e?sswWVz}nkC;$TerMӂyrr#4K/:yG۩nmOGՖ# Z&«zt|٥ `F;xֺl5_2.}g}|'L \DUX=UR!2./,77-Owsp[(&ش]Xl+dI=ss+E_2keeԗX$~VFC؎iMB@)aAjs]gO]*QmR{i.x$3Wn%$ES'R]&jΫb$s q1eA͆rK *\Okvq0xn"՘YdeEiX|ch־#wG.ʆ9MGEsGu e:'ڝqcwwu~VI(aM";+1n͕R~"q0sA {IRmY> %JTn|2&,xz亹 #H]Չ'h `0ݙu=MtJ7?] 4.ʄ7.\=Bb+lt?\Ptɸ7rwiɐ݋(iVdfB9Ue=#XగD7o]Eu}%đ<# Bake2VΒ}ai}.:TRʧ!DD 9tQY""Bp1L^ eEq@6j#sPz&P ylEҿ3&|s}y'7Fh!M*Z76귖RX~(5A٪ɖOVpm,7[3,|צ^dKyHG:VOddgv?NYV &f2$+m͂ymo~qǓ}.y;IԤUӮt߯8A!Bjs`6. |XWV{\i:>oAe X:}:ƁIpn#EgaVn0~3l鿝a40yzfk~eje5 Bj:˺bL-(zlu[8_O,̿˽/EC}j^q;M,C$X #95s PnhCмkvGoi;D*TA'?}j\uO+ySRP?,ڜn 液+ >w<ԺP#~$>lnј](ۚn\ud WP3()ERkL>ICD污M,M )m%KZ3#!`n)2VdE jwef h5]$$,WNn5'U jS(3Y5e6ޞ9[fYy噕bHf$v'lc%X8!#jh*kB|+ȕSP_F}1ywr?z7TO #ˍjIL-!ed`JǰD,ߔOxϧaZ-sS!O=iv\K-̒-Eb2]!8U{ 7͚טM[~Wy-mnh廒[i~ !v/Ԧ`ė'1l.<.95<4N,;m&z#0uHH-ŬBC]6jVvWߥr5z^i&maw,O %.Y qnA< ylE~`i^u<iQt,A2PA,Rn~VM9{EgwP~B5mfciA,va_^{ qBeϱ?&<=!gהO4y.aNn.dcIb˫? byY<6M_Q M]hܥ,ےUj?>Lc37o,~V,u(%SGwx"J,fx=FF)"|4t߸8}7Pw=0WN|%f*ň|lҭul 2z,9Wkj.N 3Ag/*o_{5y^?5ص6y%8sDX~ʑJɖ0 ۹ZGo0Wݞcbe'$.N[p& VqfUVŇS'r+HV6 2ѯǛ1gLumDƩfh#Sԑ 1rԦQ}gI9a7%oɚ'N4{byW.Cu$Fy J(@$}998O [O>X<İ[i|b6r`Z 6*CDdV' 'Ͱ̀]gw~Q״o%ei?$ӭt ;k+h2Z[YW9c8Dߩ{#󗿑8,Ni^Jп+{N~Lul"HVՖG}"/{ Qj/<[~FyKmOi/.2۠4U NfV++Ү%4_(YO68(OJǣJtVk D 9QYBp1L^ eEs@6vj#sPz&&P8%t ҽ]at3Ţg6\(v_r8>~y_Fu*0dg?\k@΄, d'Z(z~ev\4d3x,G6<"ʻx8U w| 1P-*sEʉ⾇X~9;Tqq}9l_~%}; \B4X',K 6.7NIRXQK%?~^\DSm{qo5f'ql)l̡wWq*Re:6ciVۖ-!.W* T譪ͼ~wqhL3(w:$d 9FTYBBL^ eBp1E4R@\sj#P[Vrd V٧Vrdd 9_TYBBL^ eBp1E4R@\sj#P[Vrd V٧Vrd 9uXYbb33p>`a,UdS%"#,4 'sp>4d 9XYBBL^ eBp1E4R@sj#nPޏE dd 9XYBBL^ eBp1E4R@sj#nPޏE dd 9WYYBBL^ eBp1E4R@sj#nP :dd 9YYBBL^ eBp1E4R@sj#nP :dd 9 ^YYBBBp1L^ eE4@6j#nsP*D(ޏEr&kdX 9^YY66L^ eBp1E(R@sj#nPޏE*D)PIXX 9^YY66L^ eBp1E(R@sj#nPޏE*D)PIX 9DcYYL^ eBp1ExR @sj#nPޏE*D)PGET /api/videos/10410.json HTTP/1.1 Client-Version: 1.2.1.0 Client-Uid: F356C2575A58207FB898F5256F34F1C8 Client-Source: 1kxun Client-Os: Microsoft Windows NT 6.1.7601 Service Pack 1 Client-Language: zh-TW Client-Resolution: 1116,838 Client-Brand: WINDOWS Client-Device: PC Host: jp.kankan.1kxun.mobi Connection: Keep-Alive  9hcYYL^ eBp1ExR @sj#nPޏE*D)PGET /api/videos/10410.json HTTP/1.1 Client-Version: 1.2.1.0 Client-Uid: F356C2575A58207FB898F5256F34F1C8 Client-Source: 1kxun Client-Os: Microsoft Windows NT 6.1.7601 Service Pack 1 Client-Language: zh-TW Client-Resolution: 1116,838 Client-Brand: WINDOWS Client-Device: PC Host: jp.kankan.1kxun.mobi Connection: Keep-Alive d 9YYBBBp1L^ eE4@6j#nsPƈyrdX 9YY66L^ eBp1E(R @sj#nPyPqsXX 9?YY66L^ eBp1E(R @sj#nPyPqsX 9BYYL^ eBp1ER @sj#nPyPSGET /api/movies/mp4script/10410?definition=true HTTP/1.1 Client-Version: 1.2.1.0 Client-Uid: F356C2575A58207FB898F5256F34F1C8 Client-Source: 1kxun Client-Os: Microsoft Windows NT 6.1.7601 Service Pack 1 Client-Language: zh-TW Client-Resolution: 1116,838 Client-Brand: WINDOWS Client-Device: PC Host: jp.kankan.1kxun.mobi Connection: Keep-Alive  9|YYL^ eBp1ER @sj#nPyPSGET /api/movies/mp4script/10410?definition=true HTTP/1.1 Client-Version: 1.2.1.0 Client-Uid: F356C2575A58207FB898F5256F34F1C8 Client-Source: 1kxun Client-Os: Microsoft Windows NT 6.1.7601 Service Pack 1 Client-Language: zh-TW Client-Resolution: 1116,838 Client-Brand: WINDOWS Client-Device: PC Host: jp.kankan.1kxun.mobi Connection: Keep-Alive \ 9+ZY<<Bp1L^ eE( @6bj#nsP*D)ޏFP\D 9.ZY""Bp1L^ eE @6]j#nsP*D)ޏFPHTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:20:07 GMT Content-Type: application/json;charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: Express 6f1 {"id":10410,"type":"movie","created_at":"2013-06-15 14:16:25","episodes_count":0,"episodes":[],"pubdate":"2013-10-10","year":"2013","play_count":1680941,"avg_score":4.5749,"duration":115,"language":"英语","area":"美国/法国/欧美","image":"http://pic.1kxun.com/video_kankan/images/videos/10410-jtmd.jpg","title":"出神入化","description":"　　本片讲述的是FBI与一个世界上最出色的魔术师团队斗智斗勇的故事，这支魔术师团队在表演的同时抢劫银行并把钱分给观众，使他们站在了法律和道德的灰色地带。","douban_comment_url":"http://kankan.1kxun.com/video_kankan/api/videos/doubanClick/10410","actors":[{"id":18104,"name":"迈克尔·凯利"},{"id":21881,"name":"艾拉·菲舍尔"},{"id":20631,"name":"梅拉尼·罗兰"},{"id":25297,"name":"戴夫·弗兰科"},{"id":1573,"name":"迈克尔·凯恩"},{"id":8650,"name":"马克·鲁弗洛"},{"id":125,"name":"伍迪·哈里森"},{"id":8431,"name":"杰西·艾森伯格"},{"id":84,"name":"摩根·弗里曼"}],"directors":[{"id":11685D0 9ZYBp1L^ eE @6`j#nsP*D ޏFP,"name":"路易斯·莱特里尔"}],"tags":[{"id":6,"name":"犯罪"},{"id":7,"name":"惊悚"}],"lost_episodes":[],"play_addresses":[{"type":"qqlive","name":"腾讯视频高清","url":"http://kankan.1kxun.com/video_kankan/logos/qqlive.png"},{"type":"letv","name":"乐视普清","url":"http://kankan.1kxun.com/video_kankan/logos/letv.png"},{"type":"tudou","name":"土豆高清","url":"http://kankan.1kxun.com/video_kankan/logos/tudou.png"},{"type":"youku","name":"优酷高清","url":"http://kankan.1kxun.com/video_kankan/logos/youku.png"},{"type":"bestv","name":"百事通","url":"http://kankan.1kxun.com/video_kankan/logos/bestv.png"},{"type":"imgo","name":"imgo","url":"http://kankan.1kxun.com/video_kankan/logos/imgo.png"}]} 0\ 9ZY<<Bp1L^ eE- @6bj#nsP*D ޏFP%0 \X 9ZY66L^ eBp1E(R @sj#nPޏF*D P0XX 9ZY66L^ eBp1E(R @sj#nPޏF*D P0X\ 9.ZY<<Bp1L^ eE(]:@6%j#nsPƈyPp%\D 9[Y""Bp1L^ eE];@6 j#nsPƈyP,THTTP/1.1 200 OK Server: openresty/1.9.7.1 Date: Tue, 02 Aug 2016 02:20:07 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 32122 Connection: keep-alive pd 9%]YBBL^ eBp1E4R@`s#|-~ *dd 9%]YBBL^ eBp1E4R@`s#|-~ *dd 9c^YBBBp1L^ eE4s}p@s#(b|-@JdX 9^Y66L^ eBp1E(R@ks#|-(cPXX 92^Y66L^ eBp1E(R@ks#|-(cPX 9^YL^ eBp1ER@s#|-(cPϊGET /api/qqlive_ckey/get?vid=y0013xaeeyo&platform=10902 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Host: 218.244.135.170:9099 Connection: Keep-Alive  9^YL^ eBp1ER@s#|-(cPϊGET /api/qqlive_ckey/get?vid=y0013xaeeyo&platform=10902 HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Host: 218.244.135.170:9099 Connection: Keep-Alive X 9Dr_Y66L^ eBp1E(R@sj#nP2PXX 9wr_Y66L^ eBp1E(R@sj#nP2PX 9`YBp1L^ eEs@p^s#(c|.PaCHTTP/1.1 200 OK X-Powered-By: Express Date: Tue, 02 Aug 2016 02:19:41 GMT Connection: keep-alive Transfer-Encoding: chunked ff 3.2.19.358|5.4|AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk  9{cY^=E@/kldM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9OcY66L^ eBp1E(R@hs#|.(PXX 9ucY66L^ eBp1E(R@hs#|.(PX\ 9uteY<<Bp1L^ eE-s@ps#(|.PaWf0 \l 9eYKKL^ eBp1E=RsԔ5)I8vvvideoqqcomll 9ʉeYKKL^ eBp1E=RsԔ5)I8vvvideoqqcoml 9fYttBp1L^ eEf.s5ԔRӥ8vvvideoqqcom + proxy-set1-+͗d 9fYBBL^ eBp1E4R@@s͗Pfv `dd 9kfYBBL^ eBp1E4R@@s͗Pfv `dd 9ՂfYBBBp1L^ eE4@3[͗sP%ckfv؀@ dX 9\fY66L^ eBp1E(R@Ks͗Pfv%clPAXX 9vfY66L^ eBp1E(R@Ks͗Pfv%clPAX$ 9|fYL^ eBp1ER@~s͗Pfv%clP-POST /getvinfo HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: vv.video.qq.com Content-Length: 445 Expect: 100-continue Connection: Keep-Alive $$ 9fYL^ eBp1ER@~s͗Pfv%clP-POST /getvinfo HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: vv.video.qq.com Content-Length: 445 Expect: 100-continue Connection: Keep-Alive $\ 90gY<<Bp1L^ eE($@3͗sP%clfwPr\p 9kgYOOBp1L^ eEA$@3͗sP%clfwP`>HTTP/1.1 100 Continue p 9gYL^ eBp1ER@s͗Pfw%cPencryptVer=5.4&otype=xml&appver=3.2.19.358&platform=10902&newplatform=10902&vid=y0013xaeeyo&vids=y0013xaeeyo&defaultfmt=sd&defn=sd&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&linkver=2&defnpayver=1 9gYL^ eBp1ER@s͗Pfw%cPencryptVer=5.4&otype=xml&appver=3.2.19.358&platform=10902&newplatform=10902&vid=y0013xaeeyo&vids=y0013xaeeyo&defaultfmt=sd&defn=sd&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&linkver=2&defnpayver=1 9LgYttBp1L^ eEf$@3͗sP%cfyaPJHTTP/1.1 200 OK Server: nginx Date: Tue, 02 Aug 2016 02:19:42 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 163 Connection: keep-alive 801中国-台湾省--未知IP limitfd 94gYBBL^ eBp1E4R@s*x3i dd 9fgYBBL^ eBp1E4R@s*x3i d 9"(hYgg\٘EY@@n~ n@E81\٘ n'DNS-1100-04NASUZUZ=[UZ1.02b10x\٘3A1dlink-DDF5F3 nLAN1X 9cshY66L^ eBp1E(R @`s#|.(PXX 9shY66L^ eBp1E(R @`s#|.(PX` 9iY>>Bp1L^ eE0@0*x3s ipЂ`X 9iY66L^ eBp1E(R!@s*x3i P5XX 9iY66L^ eBp1E(R!@s*x3i P5XT 9& iY22L^ eBp1E$R"@s*x3i PPOST /api/proxy?url=http%3A%2F%2Fvv.video.qq.com%2Fgetvinfo HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: 42.120.51.152:8080 Content-Length: 445 Expect: 100-continue Connection: Keep-Alive TT 9O iY22L^ eBp1E$R"@s*x3i PPOST /api/proxy?url=http%3A%2F%2Fvv.video.qq.com%2Fgetvinfo HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: 42.120.51.152:8080 Content-Length: 445 Expect: 100-continue Connection: Keep-Alive T\ 9iY<<Bp1L^ eE(G@0*x3s jP \p 9iYOOBp1L^ eEAH@0*x3s jP uHTTP/1.1 100 Continue p 9iYL^ eBp1ER#@/s*x3j PcencryptVer=5.4&otype=xml&appver=3.2.19.358&platform=10902&newplatform=10902&vid=y0013xaeeyo&vids=y0013xaeeyo&defaultfmt=sd&defn=sd&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&linkver=2&defnpayver=1 9iYL^ eBp1ER#@/s*x3j PcencryptVer=5.4&otype=xml&appver=3.2.19.358&platform=10902&newplatform=10902&vid=y0013xaeeyo&vids=y0013xaeeyo&defaultfmt=sd&defn=sd&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&linkver=2&defnpayver=1X 9jY66L^ eBp1E(R$@Cs͗Pfya%cPbXX 9jY66L^ eBp1E(R$@Cs͗Pfya%cPbX 9S1kYttBp1L^ eEf$@3͗sP%cfyaPJHTTP/1.1 200 OK Server: nginx Date: Tue, 02 Aug 2016 02:19:42 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 163 Connection: keep-alive 801中国-台湾省--未知IP limitfd 91kYBBL^ eBp1E4R%@6s͗Pfya%cÀ = %c%cdd 91kYBBL^ eBp1E4R%@6s͗Pfya%cÀ = %c%cd 9hLkY^2,E,B_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 d 9lYDD^E6S>%."<notebookd 92lY^EO5%lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 p 9.*mYNN#`GE@@@sKw8 [pd 9-mYBBBp1#E4@@AsKwD!V%d\ 9.mY<<#`GE(l@@KsKwD!WP ]rver0]\0 9n0mY#`GE@@SsKwD!WP 1W> E!PmY&Հ{/JZZW[ 0b c IU*mYBp1#EV@@sKwD!WP6ȒQM&xv}|0iJ|(Z c IU*mY<<#`GE(+N@@sKwD!P\!TTP/1.\\ 9y?mY<<#`GE.@@csKwD!P D \ 9?mY{{#`GEm7@@ 'sKwD!P @ƎMr!:;RzdV^t(_"%&Gg&&ЕgV?_"d\ 9oHmY<<Bp1#E(V@@tsKwD!:P6{\L 9mY++#`GES9@@sKw:D!P Ot ]k[E:ma#rgghuCoũ y>箫d00cnH" !V w4qx#vY. bgUNb\yLC3?< \}Y6R}pnpdLQ5Z] lXi 1.1޹nq6#2ԲoPnbIX asA9IwQ%VQNW[a(E$L/eeşĜy{uhƢ A\J3nEs싵S@d!SS;ϖ | MxCTьכr)t?"⧶NRDl.NlF]HTe (=c+]]蟡odRqwrDjS+;H#NܣgPNK 1 cf[ĉ?;qtH'A@T(2ʯ:K Di+-GƋ_ Tw7F<5=4d17y4:XYqÐPrVoIP4+;j *Cgj@Hkh[?#9rszYPHij+il ćk1TSL2^aK i"}:Ҥ9vPۀDX2ㄭq ?_=J] _ȐH-Xb"Dg$$us2i*ckN[PQ#SWϯɱ2V35 1:n^-~k@UFw!oY윂MÀU\ wy3ržDJGzrU#V΍3s/k~} nIh'Z쭳xN.Tv˫ 4۫BߪکU;Z k3B3"YnVJb@Ӂx¸ِX2X|?nf䚗7EJnSG}t3MzKdscXKL三_CPkjL@ 9XnYBp1#EV@@sKwD!/PFUp0<.w :.oVZʦƹwvL;Om;5d@2aD`2xh/^ fxR9279 k[|?G_#f|i P*j)gLC؝!=2J1['C!f3_v#bH)׶9@Ja6̂*3ӋѪ_S/6Y<ֆ֍+ߘqABe+shhS"rg#K(䫡)ք䡁R8aB`IBq)F^Z͇' nBԘ,dzWǦf%LIbWs X?˂0wP8L4xM8̗vhmPBGsĖug{H@/Ɏap7h7G]&69cGyqIaiA@nZoElSިvvD0ӽ*+8E 95Rj{{_k<vUvFz'{/`U6fMVdUtw!;1JZg\aޞ(d0i1{oա1>.?lAj5j]ojlφip}B`2uWf lK _徘piPcN]M6>+cQc%F)@0 K?;q;?P8@\ 9%YnY<<#`GE(!@@ sKw/D%PT charm\ 9$nYL^ eBp1ER&@,s*x3j PcencryptVer=5.4&otype=xml&appver=3.2.19.358&platform=10902&newplatform=10902&vid=y0013xaeeyo&vids=y0013xaeeyo&defaultfmt=sd&defn=sd&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&linkver=2&defnpayver=1 9mnYL^ eBp1ER&@,s*x3j PcencryptVer=5.4&otype=xml&appver=3.2.19.358&platform=10902&newplatform=10902&vid=y0013xaeeyo&vids=y0013xaeeyo&defaultfmt=sd&defn=sd&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&linkver=2&defnpayver=1\ 9pY<<Bp1L^ eE(I@0*x3s kPP\D 90qY""Bp1L^ eEJ@0*x3s kPPzHTTP/1.1 200 OK Server: openresty/1.9.3.2 Date: Tue, 02 Aug 2016 02:19:42 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive 14dc 125
235
高清;(480P)112120hd10
64
标清;(270P)112030sd11
64
高清;(360P)20mp410
650
超清;(720P)112010shd10
1200
蓝光;(1080P)112091fhd1000300o014701043821
34
0299.96cf923330a722948668fd58ec415813d494186551u0020mkrnds.11203.1300.0474b865e1fab341e630271eeaf95952d2138745412u0020mkrnds.11203.230016fcf5c1b54f10fb7bf7ccee0e87d14c89564523u0020mkrnds.11203.33007334b933823141d9ba2326126ca93994127854144u0020mkrnds.11203.43003f760dac8f104c985053bcbc9ed9f893163397445u0020mkrnds.11203.5300e6fe41bc1cabf818f03f5cbaf38a987e75507236u0020mkrnds.11203.63004e20cbef8e61e76b5453ddd476b6001173945367u0020mkrnds.11203.7300f52f96052981f85507429b474351815a107242448u0020mkrnds.11203.8300dc6f6ad9c46004901decf48526fb6a9789478949u0020mkrnds.11203.9300767b8fc96afd3951fcd64cb265dcd878901246910u0020mkrnds.11203.10300dbc56d4a1cb297fb8bc30366e7230b4e791459211u0020mkrnds.11203.11300cfb4edd2b05b886adf5ed8b28a8194641050649212u0020mkrnds.11203DX 9XqY66L^ eBp1E(R'@s*x3k ɌPXX 9zqY66L^ eBp1E(R'@s*x3k ɌPXD 9RrY""Bp1L^ eEL@0*x3s ɌkPP.12300a9d9328fd1f1f5d5577103b6ddd03dd81156396813u0020mkrnds.11203.133008330fb0375e584196107df6e6e4b44631009496414u0020mkrnds.11203.14300ff605eec8bc278c49fa1a990d9416e55754819115u0020mkrnds.11203.15300a4ad288ef6ecd584f6d09efda0af1d031086182616u0020mkrnds.11203.1630051e09a794a1e9413e1601d2f2182e1ee1668446317u0020mkrnds.11203.17300c4c24306b520274d5fa97521bb0918be1073352618u0020mkrnds.11203.183002c398f722b2a62c6586dd429f86237b71110852819u0020mkrnds.11203.193001693b058a23372d3416872af47f4714b1619707720u0020mkrnds.11203.203009f378271d97623b8f131f7b1a5524a521365776521u0020mkrnds.11203.213002a4a57eb35aa84a208da87fad3456c3d7DD 9MrY""Bp1L^ eEM@0*x3s xkPP54299522u0020mkrnds.11203.223000c06d6b50984aa70995f1b8466402a461195956123u0020mkrnds.11203.23582.8480a739d4fe8a4cf15e9ad2e3940887561514317424u0020mkrnds.11203.242421600100011c0c3b3c400376995f49adfbe53beec3u0020mkrnds.p1203.mp426598880057B8856B44BCC0250D0020ADF30F6D60DBEE20C511EE3CB64267D4750B38773C3F0F284FE46013C6EA88CE58D2EBABE25644EB5E24F940DF112AE7E118986B7215B8F1983A4F70091EAB92F805565E65F2539CA2B4A2F05A1920103E4016DC9DB71BE2754523811FB282B8CCB0E713B99F095C019CDDF93E200u0020mkrnds02101040001q14510http://video.qpic.cn/video_caps/0/8051040002q2905http://video.qpic.cn/video_caps/0/16010210121067487482.84惊天魔盗团1036

240y0013xaeeyo1480 0 @X 9rY66L^ eBp1E(R(@s*x3k LPXX 92rY66L^ eBp1E(R(@s*x3k LPX  9xrYL^ eBp1ER)@s͗Pfya%cP'POST /getvkey HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: vv.video.qq.com Content-Length: 437 Expect: 100-continue   9&yrYL^ eBp1ER)@s͗Pfya%cP'POST /getvkey HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: vv.video.qq.com Content-Length: 437 Expect: 100-continue p 9rrYOOBp1L^ eEA$@3͗sP%cfzP \uHTTP/1.1 100 Continue p  9rYL^ eBp1ER*@s͗Pfz%cPfilename=u0020mkrnds.p1203.1.mp4&otype=xml&appver=3.2.19.358&encryptVer=5.4&platform=10902&format=11203&vid=y0013xaeeyo&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&linkver=2&lnk=u0020mkrnds&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8   9rYL^ eBp1ER*@s͗Pfz%cPfilename=u0020mkrnds.p1203.1.mp4&otype=xml&appver=3.2.19.358&encryptVer=5.4&platform=10902&format=11203&vid=y0013xaeeyo&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&linkver=2&lnk=u0020mkrnds&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8 d 9ssYDD^E6S=%."<notebookd 9sYttBp1L^ eEf$@3͗sP%cf{P HTTP/1.1 200 OK Server: nginx Date: Tue, 02 Aug 2016 02:19:43 GMT Content-Type: text/xml; charset=utf-8 Content-Length: 163 Connection: keep-alive 801中国-台湾省--未知IP limitf< 9sYL^ eBp1E R+@s*x3k LP:POST /api/proxy?url=http%3A%2F%2Fvv.video.qq.com%2Fgetvkey HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: 42.120.51.152:8080 Content-Length: 437 Expect: 100-continue << 9sYL^ eBp1E R+@s*x3k LP:POST /api/proxy?url=http%3A%2F%2Fvv.video.qq.com%2Fgetvkey HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 Content-Type: application/x-www-form-urlencoded Host: 42.120.51.152:8080 Content-Length: 437 Expect: 100-continue <\ 9tY<<Bp1L^ eE(O@0*x3s LlP!Y\p 9YtYOOBp1L^ eEAP@0*x3s LlP!U%HTTP/1.1 100 Continue p  9tYL^ eBp1ER,@.s*x3l eP(filename=u0020mkrnds.p1203.1.mp4&otype=xml&appver=3.2.19.358&encryptVer=5.4&platform=10902&format=11203&vid=y0013xaeeyo&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&linkver=2&lnk=u0020mkrnds&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8   9%tYL^ eBp1ER,@.s*x3l eP(filename=u0020mkrnds.p1203.1.mp4&otype=xml&appver=3.2.19.358&encryptVer=5.4&platform=10902&format=11203&vid=y0013xaeeyo&cKey=AmyRxUXrPW8ZKxLACHif4vdkqR6LiRbE29Xnp6W3lQWcIq0bgcIbeAhgT4O2X94nsFFMk7ZfPRADYCI9AvkepwdWR3ANCW8Iizwm6d6cTeraogBC5IhT_Rotd2t3kZCBri5EOsOr3Tmwl1oqHdC6-KgjTAz34kIHUdBCDvLKaoVxi-zTrdFCMGjdAe3WXeNrVA4YSrRCal0HTuBVtsYmaWsD-m4Bslrx2MeF85xKOdtlQPAk&linkver=2&lnk=u0020mkrnds&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8 x 9x8vYVVL^ eEHqwCD4a1c  wp*cSc56w3<w__x\ 9NvY<<Bp1L^ eE(Q@0*x3s enYP%[\X 9̧vY66L^ eBp1E(R-@:s͗Pf{%cPXX 9vY66L^ eBp1E(R-@:s͗Pf{%cPX  9vYBp1L^ eEݤR@0*x3s enYP%3HTTP/1.1 200 OK Server: openresty/1.9.3.2 Date: Tue, 02 Aug 2016 02:19:43 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive 1fa
31399.705078125
21600u0020mkrnds.p1203.mp47AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE65694457E3F53549CD617D5C9F671A26C70DC68F93F1D7BCD017762Fu0020mkrnds.11203.101o00 0 d 92wYBBL^ eBp1E4R.@s0P[^ %dd 92wYBBL^ eBp1E4R.@s0P[^ %dh 9SwYEE^oE7'Ce!X#^v Joanna-PChh 9$wYEE^p*E7}B X# Joanna-PCh 9wY^oEA_2lRM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9YwY^H$c E~!_)láM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 \ 9'OxY<<Bp1L^ eE,@1.0sP̏l9[^`9\X 9OxY66L^ eBp1E(R/@s0P[^l:PXX 9PxY66L^ eBp1E(R/@s0P[^l:PX 9hyxYL^ eBp1ER0@*s0P[^l:P9GET /vlive.qqvideo.tc.qq.com/u0020mkrnds.p1203.1.mp4?vkey=7AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE65694457E3F53549CD617D5C9F671A26C70DC68F93F1D7BCD017762F&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8 HTTP/1.1 Host: 183.131.48.145 Range: bytes=0- Connection: close Icy-MetaData: 1  9yxYL^ eBp1ER0@*s0P[^l:P9GET /vlive.qqvideo.tc.qq.com/u0020mkrnds.p1203.1.mp4?vkey=7AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE65694457E3F53549CD617D5C9F671A26C70DC68F93F1D7BCD017762F&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8 HTTP/1.1 Host: 183.131.48.145 Range: bytes=0- Connection: close Icy-MetaData: 1 h 9EXyYEE^oE7'Ee!X#^v Joanna-PChh 9{byYEE^p*E7}E X# Joanna-PCh\ 9yY<<Bp1L^ eE(@1T0sP̏l:[^P+2\ 9yYBp1L^ eE@1Q0sP̏l:[^P+r~HTTP/1.1 302 Moved Temporarily Server: httpserver Location: http://183.131.48.144/vlive.qqvideo.tc.qq.com/u0020mkrnds.p1203.1.mp4?vkey=7AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE65694457E3F53549CD617D5C9F671A26C70DC68F93F1D7BCD017762F&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&locid=a06f98fd-fa26-44e5-acc5-0d83f9df03af&size=9418655&ocid=253564332 Cache-Control: max-age=7200 Connection: close Content-Length: 0 X-ServerIp: 183.131.48.145 X-RespTime: 02/Aug/2016:10:19:44 +0800 X 9yY66L^ eBp1E(R1@s0P[^lڳPw9XX 9yY66L^ eBp1E(R1@s0P[^lڳPw9Xd 9.yYBBL^ eBp1E4R2@s0PR'; _dd 9MyYBBL^ eBp1E4R2@s0PR'; _dX 9zY66L^ eBp1E(R3@s*x3nY P"3XX 9-zY66L^ eBp1E(R3@s*x3nY P"3X\ 9ūzY<<Bp1L^ eE,@1.0sP+aR'<`9`\X 9EzY66L^ eBp1E(R4@s0PR'<+aPhXX 9_zY66L^ eBp1E(R4@s0PR'<+aPhX\ 9RzY<<Bp1L^ eE(@1T0sP̏lڳ[^P+\P 9zY--L^ eBp1ER5@s0PR'<+aPhSGET /vlive.qqvideo.tc.qq.com/u0020mkrnds.p1203.1.mp4?vkey=7AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE65694457E3F53549CD617D5C9F671A26C70DC68F93F1D7BCD017762F&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&locid=a06f98fd-fa26-44e5-acc5-0d83f9df03af&size=9418655&ocid=253564332 HTTP/1.1 Host: 183.131.48.144 Range: bytes=0- Connection: close Icy-MetaData: 1 PP 9 zY--L^ eBp1ER5@s0PR'<+aPhSGET /vlive.qqvideo.tc.qq.com/u0020mkrnds.p1203.1.mp4?vkey=7AB139BF6B32F53747E8FF192E6FE557B3A3D644C034E34BF6EAEB4E0774F2A92EF3AC5C007520BB925E5C8A18E6D302C2DAE0A295B26AA8FD1DC8069D47CE1B4A16A56870BD1ACA3E86ABE4C079659DB2182FC71217AB68CCD344CE65694457E3F53549CD617D5C9F671A26C70DC68F93F1D7BCD017762F&guid=F5EB01CC01A8E08CD83630828DE17C2B02162FD8&locid=a06f98fd-fa26-44e5-acc5-0d83f9df03af&size=9418655&ocid=253564332 HTTP/1.1 Host: 183.131.48.144 Range: bytes=0- Connection: close Icy-MetaData: 1 PX 9$zY66L^ eBp1E(R6@s0P[^lڴPw8XX 9EzY66L^ eBp1E(R6@s0P[^lڴPw8X\ 9){Y<<Bp1L^ eE(@1{20sP+aR'3P+j\p 9{YOOBp1L^ eEA@1z0sP+aR'3P+bHTTP/1.1 206 Partial Content Content-Range: bytes 0-9418654/9418655 Access-Control-Allow-Origin: * Content-Length: 9418655 Accept-Ranges: bytes Date: Tue, 02 Aug 2016 02:19:45 GMT Content-Type: video/mp4 X-ServerIp: 183.131.48.144 X-RespTime: 02/Aug/2016:10:19:45 +0800 pX 9c{Y66Bp1L^ eE(@1w00sP+aR'3P+ftypmp42isomavc1mp42bmoovlmvhdӑ%ӑ%X@iodsO(_*trak\tkhdӑ%ӑ% @^mdia mdhdӑ%ӑ% arlU,hdlrvideTrackHandler^Nminfvmhd$dinfdref url ^stblstsdavc1HH4avcCdgdPx~`a,UdS%"#, 'sp>X 97;Y66Bp1L^ eE(@1w*0sP+aR'3P+p p p p p p p  p p p  @X @p p X pXX 9;Y66Bp1L^ eE(@1w)0sP+aR'3P+< p @p p p  p p X    p X XX 9e!ؽlbM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9OͩY^p*E ؼlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9ΩY^^RE0Ҍ9lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9[Y^H$c1E:,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9Y66L^ eBp1E(R>@s0PR'3+b PXXX 9KY66L^ eBp1E(R>@s0PR'3+b PXX 90Y^E 1luM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9Y66Bp1L^ eE(@1w&0sP+b R'3P+ p p  X @p X p X  p  X  XX 9Y66L^ eBp1E(R?@s0PR'3+bPXXX 9NY66L^ eBp1E(R?@s0PR'3+bPXXX 9ñY66Bp1L^ eE(@1w%0sP+bR'3P+ X p p X   X  X X p X   X X Xt 93YRR" PY1ED@@.W;x0rSu2oVSt4AABHZW50cmljZV9BUENfZ3Vlc3QAbWUAtX 9Y66L^ eBp1E(R@@s0PR'3+bP~XXX 9'Y66L^ eBp1E(R@@s0PR'3+bP~XXX 9rY66Bp1L^ eE(@1w$0sP+bR'3P+Cv@X p p X X X X p p X  X @@X @X  p X  XX 9ytY66Bp1L^ eE(@1w#0sP+bR'3P+p  p X p X @ p p X p X   @XX 9tY66L^ eBp1E(RA@s0PR'3+bPvXXX 9uY66L^ eBp1E(RA@s0PR'3+bPvXX 9oY^=E@/kldM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9Y66Bp1L^ eE(@1w"0sP+bR'3P+Qp p  X X  p X p p  X X X p  X X X X 9#YkkBp1#E]V@@=sKwD%/PF0 ڲ_%͢!ʐ! Ӿ'cDNdoPGy˝<^N\ 9#Y<<#`GE(@@EsKw/D&PS VES16\\ 9#Y<<Bp1#E(V@@qsKwD&/PFsv\\ 9#Y<<#`GE(|@@sKw/D&PS\X 9Y66L^ eBp1E(RB@s0PR'3+bPvXXX 9=Y66L^ eBp1E(RB@s0PR'3+bPvXX 9Y^2,E,D_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9Y66Bp1L^ eE(@1w!0sP+bR'3P+p @X @ X X  p p p     @ @X p X 9Y^EQ3%lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9Y66L^ eBp1E(RC@s0PR'3+b#PnXXX 9Y66L^ eBp1E(RC@s0PR'3+b#PnXXX 9DY66Bp1L^ eE(@1w 0sP+b#R'3P+tp X p p  X p  X p  X X X X X p X X XX 9Y66L^ eBp1E(RD@s0PR'3+b'PnXXX 9ơY66L^ eBp1E(RD@s0PR'3+b'PnXXX 994Y66Bp1L^ eE(@1w0sP+b'R'3P+ p  X X X p X X     p  p p  p @XXX 9AY66L^ eBp1E(RE@s0PR'3+b+PfXXX 9CAY66L^ eBp1E(RE@s0PR'3+b+PfXXX 9dY77L^ eBp1E)RF@=sBW+A4aPXX 9Y77L^ eBp1E)RF@=sBW+A4aPXd 9-YBBBp1L^ eE4f=aBWs4a+A훺 +A+Ad 9["Y^oE'L| 8d 9"Y^=E@/kldM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9&Y66L^ eBp1E(RJ@s0PR'3+b?PVXXX 9C&Y66L^ eBp1E(RJ@s0PR'3+b?PVXXX 9Y66Bp1L^ eE(@1w0sP+b?R'3P+qX @ p p p p p X p X X X p X X X  p  XX 9Y66L^ eBp1E(RK@s0PR'3+bCPNXXX 9%Y66L^ eBp1E(RK@s0PR'3+bCPNXX 99Y^2,E,E_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9-Y66Bp1L^ eE(@1w0sP+bCR'3P+p @ X @X  X p X p p p p XX 9Y66Bp1L^ eE(@1w0sP+bGR'3P+kp p p  p X p X X p p X @    X  X p p XX 9xY66L^ eBp1E(RL@s0PR'3+bKPFXXX 9Y66L^ eBp1E(RL@s0PR'3+bKPFXX 9_Y^ER2%lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 p 9YNNL^ e`GE@7@@DxPET <@pl 9YJJBp1L^ eE<@5=DPxv8zEH 8<@ld 9£YBBL^ e`GE4<@@DxPEv8{}/ =8dl 9YKKL^ e`GE=b@@91DxPEv8{M& =8GET /comMagicanApi/composite/app.php/Global/Index/ip HTTP/1.1 Host: api.magicansoft.com Accept: */* Accept-Language: zh-tw Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: Magican (unknown version) CFNetwork/720.5.7 Darwin/14.5.0 (x86_64) l 9/Y33L^ T`N^ T..j}h?L^ T6.35.1 (stable)MikroTik | 3DXY-KHGD CRS125-24G-1SN^ Tbridge1X 9:Y66Bp1L^ eE(@1w0sP+bKR'3P+X p  X p p p p p  p p  p X  p p Xd 9YBBBp1L^ eE4@5MDPxv8{F€Y =d 9YBp1L^ eEx@5KDPxv8{F€ =HTTP/1.1 502 Bad Gateway Server: MServer 1.2.2 Date: Tue, 02 Aug 2016 01:58:34 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive 502 Bad Gateway

502 Bad Gateway

nginx
d 9YBBL^ e`GE4NR@@JDxPFv8 yY =d 9JZgg\٘EY@@n~ n@E81\٘ n'DNS-1100-04NASUZUZ=[UZ1.02b10x\٘3A1dlink-DDF5F3 nLAN1X 9eZ66L^ eBp1E(RM@s0PR'3+bOPFXXX 9Z66L^ eBp1E(RM@s0PR'3+bOPFXXX 9= Z66Bp1L^ eE(@1w0sP+bOR'3P+p p p p p  p X p p p p p XX 9,Z77L^ eBp1E)RN@vfs@齀PxGBPzs+XX 9,Z77L^ eBp1E)RN@vfs@齀PxGBPzs+Xd 96OZBBBp1L^ eE4k.@齀sPGBxWQ+ xxd 9,Z^p*E ؼlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9SZ^oE'R|6e!ؽlbM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 x 9ZVV33XXX 9Z66L^ eBp1E(RO@s0PR'3+bSP>XX 9 Z^E 1luM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9ݝ Z66Bp1L^ eE(@1w0sP+bSR'3P+^    p X X p p  p  X X X| 9b Z\\XXX 9 Z66L^ eBp1E(RP@s0PR'3+bWP>XXX 9[0Z66Bp1L^ eE(@1w0sP+bWR'3P+ p p p p X p p   p p X X X X XX 9=Z66L^ eBp1E(RQ@s0PR'3+b[P6XXX 9/>Z66L^ eBp1E(RQ@s0PR'3+b[P6XX 9_{ZggsWEY;@@_EՠsW'DGS-1210-10PSwitch3.10.013sWB1QP0R1D9000026DGS-1210-10PPort 8   sW@ 9Z33sW`Q   sWQ0ՠsW   sW'DGS-1210-10PSwitch3.10.013sWB1QP0R1D9000026DGS-1210-10PPort 8   sW@X 9]Z66Bp1L^ eE(@1w0sP+b[R'3P+X p p p p p @X X p p  p X X XX 9w^Z66Bp1L^ eE(@1w0sP+b_R'3P+Pp X X p X X p X X| 9S/Z\\qENrE@-:N FDEBEOEKEJCNEMEJEGEFECEPEPELCNCA | 9 0Zbb33p>`a,UdS%"#,K 'sp>X 9|lZ66L^ eBp1E(RR@s0PR'3+bcP.XXX 9lZ66L^ eBp1E(RR@s0PR'3+bcP.XX 9NZ^=E@/kldM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9pZ66Bp1L^ eE(@1w0sP+bcR'3P+ p X @p p p p  p  X XX 9| Z66L^ eBp1E(RS@s0PR'3+bgP.XXX 9} Z66L^ eBp1E(RS@s0PR'3+bgP.XX| 9z"Z\\.vrE\X 9 yZ66Bp1L^ eE( @1v0sP+bR'3P+H1X p p   p  p p     p  Xt 9yZRR^d.<ED@1@0 _googlecast_tcplocal tt 9N+{ZRRA:ED@@wG0icRVSoU9AABXZWJDYWxsAHVtRG9sb3JTaXRBbWUAtX 9|Z66L^ eBp1E(Rb@s0PR'3+bPWXX 9U|Z66L^ eBp1E(Rb@s0PR'3+bPWXX 94Z66Bp1L^ eE(@1v0sP+bR'3P+n   p p p p  stscU                ! " % & ) * - . 0XX 9AZ66L^ eBp1E(Rc@s0PR'3+bPWXX 9BZ66L^ eBp1E(Rc@s0PR'3+bPWXX 9ҾZ66Bp1L^ eE(@1v0sP+bR'3P+ 1 4 5 8 9 < = ? @ C D G H K L N O R S V W Z [ ] ^ a b e f i j l m p q t u x y { |                                             Xh 9Q'ZFF^l@:E8AE0$L Kasper-machX 9ˆZ66L^ eBp1E(Rd@s0PR'3+bPWXX 9 ̆Z66L^ eBp1E(Rd@s0PR'3+bPWXX 9GZ66Bp1L^ eE(@1v0sP+bR'3P+                                           ! $ % ( ) , - / 0 3 4 7 8 ; < > ? B C F G J K M N Q R U V Y Z \ ] ` a d e h i k l o X 9;ZL^ E@@yad.lL^ 4MNAT6.35.1 (stable)MikroTik $ N538-G04U RB450Gether2d 9ҊZDD^^RE619~"%4Usher-PCd| 9ՊZ[[33o`%4a$%+ charming-PC|h 9֊ZGG^oE9K'2$%+ charming-PCh 9׊Z^oEA]2lRM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9SZ66L^ eBp1E(Re@s0PR'3+bPWXX 9TZ66L^ eBp1E(Re@s0PR'3+bPWXd 9l[ZDD^^RE619~"%4Usher-PCdh 9\ZFF^l@:E8f0$L Kasper-mach 9@\Z^H$c E~1O)láM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 T 9Z22^E$ 1llNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 Tp 9kZNN33 ` /WP llaNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 pX 9?iZ66Bp1L^ eE(@1v0sP+bR'3P+p s t w x z { ~                                                                              XX 9iZ66Bp1L^ eE(@1v0sP+bR'3P+)          # $ ' ( + , . / 2 3 6 7 : ; = > A B E F I J L M P Q T U X Y [ \ _ ` c d g h j k n o r s v w y z } ~  u@stszK$,8g!P$&,W-+2-(#.$#kS#)s*+s1)30($*e(2F-"X 9 Z^^RE1]9lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 h 9 ZGG^oE9K&2$%+ charming-PChD 9 Z$$^E 1lliNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:service:ConnectionManager:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ConnectionManager:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 D` 9l Z@@33 `  /WP ll NOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:service:ConnectionManager:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ConnectionManager:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 `X 9vZ66L^ eBp1E(Rf@s0PR'3+bPWXX 9vZ66L^ eBp1E(Rf@s0PR'3+bPWXD 9H-Z""^E 1llNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:service:ContentDirectory:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ContentDirectory:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 D` 9.Z>>33 ` /WP llNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:service:ContentDirectory:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ContentDirectory:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 `X 9BZ66Bp1L^ eE(@1v0sP+bR'3P+53"9/2.83:7#$C+DD?%'47)!+{F/#f4pmvg''D+|B"x =1-hB9T-"%f)'!#6['BX_*%"F7K"t:~;A3q&OoYl;6{LY-,*r1FY'B-}O#0TKD~&BX|s"y%`aHd->96N~6y! S32%Ca (X}X 96ݘZ^l@:E0%lIM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9BwZgg\٘EY@@n~ n@E81\٘ n'DNS-1100-04NASUZUZ=[UZ1.02b10x\٘3A1dlink-DDF5F3 nLAN1X 9RZ66L^ eBp1E(Rg@s0PR'3+bPWXX 9Z66L^ eBp1E(Rg@s0PR'3+bPWXh 9ݒZGG^oE9K 2n%"= charming-PChX 9rZ66Bp1L^ eE(@1v0sP+bR'3P+V###.!!'E<\7".!E6 O,2*+$!?"78.#f6%3U_[3YP8:H+xM2_9E^sG  "gu]ETA%Z>,VM-WI@h L CS ;lG ? Mlm@{CO?:Q6Paa 9M Q  d3C~;><> 3CuE X8 9Z^E 1llNNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:device:MediaServer:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:device:MediaServer:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 8T 9EZ2233 ` /WP llBNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:device:MediaServer:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:device:MediaServer:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 TX 9:Z66L^ eBp1E(Rh@s0PR'3+bPWXX 9lZ66L^ eBp1E(Rh@s0PR'3+bPWXX 9GZ66Bp1L^ eE(@1v0sP+bR'3P+L; I>\B mI6 A< .;) Na 7A '<40 {CY aAt1Z,3U?6TB5iq6\\B k 5 K@X#<c )8#A\4l}N01;{,41B&<><8/H6;n:41e:NB"[X^>j5]KT&p = $ _.<>ODYMCE#):cZXX 9TZ66L^ eBp1E(Ri@s0PR'3+bPWXX 9TZ66L^ eBp1E(Ri@s0PR'3+bPWXX 9ѦZ66Bp1L^ eE(@1v0sP+bR'3P+xU>%APr;^@A Gm, 02 e48])F3!<YRN6IVb:|j7:CJ)E!HdJ^1 HI8QI!MQPa nf&D jG>F@;BRJuKLiL )HkgSrciEL> M-| : 8 = ZB1 B S9er  F Bm3E C_\ UYY r<?GSH \T hdG)S$e=Q ><w-N3Xx 9{ZVV{ EH@DC43%z{ cSc59< dhcpcd-5.5.6 android-f7ca0f571270c52d7 !3:;xt 9QZRRr2ED@@.];x0dDYcTc4PAABPcGVuYnRzAHVtRG9sb3JTaXRBbWUAtX 9ܩZ66L^ eBp1E(Rj@s0PR'3+bPWXX 9ܩZ66L^ eBp1E(Rj@s0PR'3+bPWXX 9*߬Z66Bp1L^ eE(@1v0sP+bR'3P+..U=M  '8,> ]o; =4$</1ZD x[P Mn0E V;K@N_MJ NQPH%JJP Q N7DTrB-_EFH<E<GN*Lf3sHaY7+*IBDGF"T0 Kq o.(OH=>HKkL/\F10,  > L */b AR 9V^sMS&uivZ k^L3_Z=f;PO @QE&T!i?9'K cX\ 9߬Z<<#`GE('@@sKw/D&P S[4D\X 90Z66Bp1L^ eE(@1v0sP+bR'3P+]8=\#_n&QQe;A%xLon% ": YM =(4?FG gc B >b 'HQW"h  I j0 S13PM7;yL1f`]~/MAEdnH:DvE2DI`( :3ylthSa+Z^h(TFtsA7[?Q8U fG ]D Fp ; RJROm<_o[i0=shURZ}oO56ruqJdZ8~iYXX 9Z66L^ eBp1E(Rk@s0PR'3+bPWXX 9Z66L^ eBp1E(Rk@s0PR'3+bPWX\ 9&Z<<Bp1#E(@@A$sKwD&0PFsu\d 9ZCCL^ e`GE5@@DxPFv8 ) jGET /comMagicanApi/index.php/ToolBox/version HTTP/1.1 Host: api.magicansoft.com Accept: */* Accept-Language: zh-tw Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: Magican (unknown version) CFNetwork/720.5.7 Darwin/14.5.0 (x86_64) dp 9ZNN#`GE@(@@&sKypuU j=pd 9ؠZBBBp1#E4@@AsKyʙpvдcd\ 9Z<<#`GE(@@ZsKypvʙP )ť\, 9)Z  #`GE@@ksKypvʙP WS%_kM-U͌lCf5j.) c IU*W c IU*YeD^hˍ?PF9޺0"ƲYq8-a/Tؾ_$2íG%`6OP.N଑]63霟uѰwC@c '7DjJ !:#m1xXkjm)zR/#P[a@~Pt.f|]*u2v& !;#_3C j>whjr,wc*.tBHTs(M{_4 :^֒4]DaU*n zV 4GZ|@oc1Hc"Fޫm{R"{ ;"}Z:mIrC&.s ͑SۣTVɮCNKpp1*5pd@:~ 7 |c '8vsjG$UKf+bFf$(0$量u)T<5p6*.EiZBrV#SjJT)uoC]K1 -Qm]i8?\y*@ƀ5{7OAcp8<:% j7Ftbأ*Nt6g춈B7}`k~ h|:uGS0:k0P&]{8.-aw绁c; ߃JCMU$WPℷ 5!lm/.ʃ<%ΒVEٴqΎoʐihGJPh/ņZዉa~@0R X[fne|J\}6<#$ DU3ʘ[:8d +E!VԘ{Hx|v1;p-u[-V;;֑z F]{aB:2{P0T+Lr.R.%ᵟ}PsAخ0+6>DNp zluE~cӅiN:7@;7 R@~4L2=ilOn&&`7R Me_atP툐94mpzx,* b#j?1& `CI/!^'j\;ElP:gD2aN}QHztc`)UY )h@i !8ʝ yA8u_&Węb㽹=SɁ}(*T?73Ycx!ʏi2< u[\[30;3f{M6õQɟi V$xXbTW*zU _|{,1 To V9sl&?QٳrUy_((Yi5tR1AlCy /-3s'G&rGX6 1DYE%0P1}qm™ߠVY;mMS9!3|0[`GxkW X]x:sc7ȹRʀx=-@\ 9RZ<<#`GE(@@RfsKypʚbPq-\ 9 ZBp1L^ eEx@5KDPxv8GÀ$ M%jHTTP/1.1 502 Bad Gateway Server: MServer 1.2.2 Date: Tue, 02 Aug 2016 01:58:46 GMT Content-Type: text/html Content-Length: 166 Connection: keep-alive 502 Bad Gateway

502 Bad Gateway

nginx
d 9; ZBBL^ e`GE4ב@@[ DxPGv8 jM%d 9ZL^ eE@@w.RL^ e300MNAT6.35.1 (stable)MikroTik $ AXRJ-X6SG RB450G 0ether2-master-local 9Z33L^ e`N^ e..JRL^ e300MNAT6.35.1 (stable)MikroTik $ AXRJ-X6SG RB450G 0ether2-master-local  9Z^E G1llDqNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: uuid:9319395a-4d03-4750-bb1b-4663933ab812 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 ( 9=Z33 ` /WP lldNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: uuid:9319395a-4d03-4750-bb1b-4663933ab812 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 (| 9f~ZYY33V=#XX 99Z66L^ eBp1E(Rl@s0PR'3+bPWXX 9jZ66L^ eBp1E(Rl@s0PR'3+bPWX 9>Z^oEA\2lRM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9Z^E O1llʓNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: upnp:rootdevice NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::upnp:rootdevice Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948   9RZ33 ` /WP llyNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: upnp:rootdevice NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::upnp:rootdevice Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 x 9ZVVL^ eEHqwCD4~B,,wH$c1cSc56w3<w__x 9įZ^H$c E~2N)láM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 d 9HZDD^H$c1E6; ,N"jason-PCdT 9TZ22^E$ 1llNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 Tp 9NUZNN33 ` /WP llaNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:microsoft.com:service:X_MS_MediaReceiverRegistrar:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 pX 9(Z66Bp1L^ eE(@1v0sP+bR'3P+dQ?H PSQv [M`iyQ FNxN8P9CQN&[_2SLtfxL,[Z_B0E _cZ<S?;}58e SE'FL LX n<.J^4EIF{&s 33MI` ^[@Ck 05B]1zh bG;N=;*]@<DMRs@;S}75b?wDT S9|gB7fM g)D4AAoZ-< cXd 9hͼZDD^H$c1E6;,N"jason-PCd 9ͼZ^^RE1[9lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9oZ^H$c1E;k,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 95Z66L^ eBp1E(Rm@s0PR'3+bPWXX 95Z66L^ eBp1E(Rm@s0PR'3+bPWXD 9Z$$^E  1lliNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:service:ConnectionManager:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ConnectionManager:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 D` 9Z@@33 `  /WP ll NOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:service:ConnectionManager:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ConnectionManager:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 `X 9Z66Bp1L^ eE(@1v0sP+bR'3P+G]-sazq4@Cf|:j kR?VPYL B~:1`[?RII~4ML/k&:vZVj$ HY1xY[OjfGASg4[k@C  DEmV) 7]=Q"Z0B9KIHDVzCb4Gu? #uLBS6rK HlfxX0RM=}WEy2E:R hV'=v7HPqXD 9Z""^E  1llNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:service:ContentDirectory:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ContentDirectory:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 D` 9)Z>>33 ` /WP llNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:service:ContentDirectory:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ContentDirectory:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 `X 9~Z66L^ eBp1E(Rn@s0PR'3+bPWXX 9Z66L^ eBp1E(Rn@s0PR'3+bPWXx 9`ZVVL^ eEHqwCD4W{4t$$w&ZcUcSc56w3<w__*_ {-txX 9c`Z66Bp1L^ eE(@1vﷃ0sP+bR'3P+X Nw [ ?>HjbEFsUTFk>O\ ;@F re z"|7?AG!>|E]6<+(,yBC94 m8XcJBVZBhiVTK7D5c@ P@:8a YGTE 0B%  103. QO y>4\ !A8TOc?}<m0mlH\BJ*!YL=H1n@^Mk\[HG48hHO@(s5|BbM5!] Z IUX 9;Z^l@:E \0%lIM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9lZ66L^ eBp1E(Ro@s0PR'3+bPWXX 9mZ66L^ eBp1E(Ro@s0PR'3+bPWX 9PUZbb33{ ކ`,{ "#,} 28k&qiX 9BdZ66Bp1L^ eE(@1v0sP+bR'3P+^gi afE yG8 @c,xQ 0F6  ] +OF  O>`=;M.>Bi[F(b =? u_@7`M]A;l32ECUAo5.Q$`2h0CN5~= C-?f5 ,%-]m P3qS `:<akx 96y!QVZSY_, )sGfd{NCU$8-X{- &5o7< #tIQ b sqa]l7C Q 7 psB Ju: 6MXX 9fZ66Bp1L^ eE(@1v0sP+bR'3P+R& e3y9! ~@ }?P "U fM E GVM@d@zs7 5_hpmaLbELH;h b>AXLhu,8#iOt`G,B<(X T=9$s.\SY*BE E]g8!$>\ > 8/ N4EWnA=8fBoaWvTY <oAQ=,`%)B}a,z[#e%1 G"#'? SuK ^ i<&BXX 9fZ66L^ eBp1E(Rp@s0PR'3+bPWXX 9gZ66L^ eBp1E(Rp@s0PR'3+bPWX8 9mZ^E 1llNNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:device:MediaServer:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:device:MediaServer:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 8T 9WnZ2233 ` /WP llBNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:device:MediaServer:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:device:MediaServer:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 T| 9΍Z\\ d -rMOK/+57L4Ic u<<gjFaZZ4LJ %O =i>/% | # :I {t GOe w^ TzL  \;g jo db; ?T <)mp< 3N` p^SV MN hT RH, # Oga 9.D [:> J z( )5_+:8 ?q Nz|j }Ua{yXX 9Z66L^ eBp1E(Rq@s0PR'3+bPWXX 97Z66L^ eBp1E(Rq@s0PR'3+bPWXX 9Z66Bp1L^ eE( @1v뷃0sP+bR'3P+}p[bZ sD}]I.Cak y SF j0t@C XZ k[F P@_q=] ;a pC?qSc'E   !9+CQynWC<+/H 3 ;N' ?K!J f8 YEGZ` MBpym<"3YL|NwB(EqG~,rX@ _=3 KZO`iU`3B22%C} ): ZCO nE&eFcq X| 9 Z\\>%REEyQw{& 'E0Cj!m7sH&h u\X 9Z^l@:EP0%lIM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 95FZ66L^ eBp1E(Rs@s0PR'3+bPWXX 9^FZ66L^ eBp1E(Rs@s0PR'3+bPWXX 9Z66Bp1L^ eE("@1v鷃0sP+bR'3P+}vH@3 @6H"JD TW8 eCl N\dSAvg :$Agi)SFPCG}:""?x -:9J Q-]nAGOZ 2:s 9@ 0V{U? [:!cbSWIG4+Qc eG FIPU E Q5p"M+~ [2d(rZgD(<P Vz.4eG+ $ CfQ rPx' UlX 9tZL^ VGOE@@w .)L^ VGO IPv6Route6.35.4 (stable)MikroTik 6 VS1L-Q18R RB450G 0LANX 9Z66L^ eBp1E(Rt@s0PR'3+cPWXX 9?Z66L^ eBp1E(Rt@s0PR'3+cPWX| 9#Z\\r )C()11!c9g,0 hbek,+*I d| Z[e\!Mg r2]$&@w 2V\eZG : GwBhl8 i{H,?Mo9  P:<XX 9Z66Bp1L^ eE($@1v緃0sP+cR'3P+Ȅu \x?g X@E}F3 $8`RNe[G|fZb FS R&{=D9B $=M ET. EJRa<%P3/,X1>HSEJ/;T(;ioRBj:> }=cw _I3-y{U\Y/ c{<s *6vFt$xLn[21 $ > F 13.Sg> ,`3 F  g 6X 9rZ^^RE1889lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9Z66L^ eBp1E(Ru@s0PR'3+c PWXX 9Z66L^ eBp1E(Ru@s0PR'3+c PWX 9;HZ^H$c1E;d,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 D 9HZ$$^E 1lliNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:service:ConnectionManager:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ConnectionManager:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 D` 98IZ@@33 `  /WP ll NOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:service:ConnectionManager:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ConnectionManager:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 `D 9Z""^E 1llNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: urn:schemas-upnp-org:service:ContentDirectory:1 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ContentDirectory:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 D` 9Z>>33 ` /WP llNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: urn:schemas-upnp-org:service:ContentDirectory:1 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812::urn:schemas-upnp-org:service:ContentDirectory:1 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 `x 9aZVVL^ eEHqwCD4v_S//w=cSc56w3<w__xx 9.ZVV33=` $  +=RO_X1Cxd 9`ZBB^=E4-/ A=RO_X1CdX 9F&Z66Bp1L^ eE(%@1v淃0sP+c R'3P+ \ _9Sj=9i C  +4gw A es 'NU^( :Nd l ,vkBX+> |]^, vs(-ze&uGh 3q[ ^M G U P^J " V  (^s(Am /*y 1, C) A 5ih Gx j ]= x 2 N wcr c @S< 1  -ncm yW, =(  ME   <% ;HX 9~Zbb33{ ކ`,{ "#,| 28k&qiX 93Z66L^ eBp1E(Rv@s0PR'3+cPWXX 93Z66L^ eBp1E(Rv@s0PR'3+cPWXx 9X9ZVV33=` $  +=RO_X1Cxd 9f9ZBB^=E4- / A=RO_X1CdX 9JTZ66Bp1L^ eE(&@1v巃0sP+cR'3P+ Q_9 [  Yx ( Bl G._j p]4 J|[k L$ vO+*EktTJ~ *J:I d?"h \x ]11_&uvi].w >evt<\ry~Lh:a*':S Is M < sh)@ bilwI5'_>SL 0 Jxw 8 XIa\ &> rmXX 9$Z66Bp1L^ eE('@1v䷃0sP+cR'3P+fXTY M\_q6%I1<f-at2f0E` ?a7|=`h%z5X ]  r  jLR([D) mac e C; v!BCzz Gp/u/y t O H" cM ~)pV ++ O mN F EbXR2# -- k&O<`1 UHF% [sMy7 Pk9<AcvXX 9սZ66L^ eBp1E(Rw@s0PR'3+cPzWXX 9Z66L^ eBp1E(Rw@s0PR'3+cPzWXd 9[BBL^ e`GE4Y@@ DmP@a> |dX 9PQ[66Bp1L^ eE((@1v㷃0sP+cR'3P+   FX"Ha085) H;20QM2 b=;jr?  i< hz # 2r.  SV' \'SbE GP&9?7Wq5-X2LI`3i N: 13 X++%c~1/MU o  ?.sAd;0SCnXX 9^[66L^ eBp1E(Rx@s0PR'3+cPzWXX 9^[66L^ eBp1E(Rx@s0PR'3+cPzWX| 9H[\\332,`&鏺k&1St 小佛專機|h 9FH[HH^2,E:+ _&St 小佛專機h 9H[^2,E,G_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9}[66Bp1L^ eE()@1vⷃ0sP+cR'3P+ę4vBL@!**" [  6 \ |+|  *7  4m. 9[ p P@ {g|a{ lIJJ3  J4i *%#_J]$ )%  ,6 S qIH  w/ . eUM XR5-1%._w}#{9y @rHI yV  A[e0 u5ZoC U1 vL E ` B # !F%C'$ ..XX 9 ~[66Bp1L^ eE(*@1v᷃0sP+cR'3P+qit g-]@N-j 'Nj > f3 HFP  &  K % `4 >8zi ' % CO# y # #oh>U6 VR#nl B \QJ T WL]h>y4N ;0Vq/*N(9ajE`E ]2 A,32*8 v5:a< :P Hx ?P& ) / d/! p{ &O J3 X 9N> [kkBp1#E]|@@sKyʚbpPF0Ps%L氳{=ޘpcO~2۱!']4\ 9> [<<#`GE(W@@asKypʚP3\\ 9> [<<Bp1#E(|@@(sKyʚpPF\\ 9> [<<#`GE(1@@$sKypʚP2\X 9Ō [66L^ eBp1E(Ry@s0PR'3+c#PnWXX 9 [66L^ eBp1E(Ry@s0PR'3+c#PnWX| 9 [\\332,`&鏺k&1St 小佛專機|h 9" [HH^2,E:+"_&St 小佛專機h  9)[^E ;1llDqNOTIFY * HTTP/1.1 Host: 239.255.255.250:1900 NT: uuid:9319395a-4d03-4750-bb1b-4663933ab812 NTS: ssdp:alive Location: http://192.168.5.49:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 ( 9[33 ` /WP lldNOTIFY * HTTP/1.1 Host: [FF02::C]:1900 NT: uuid:9319395a-4d03-4750-bb1b-4663933ab812 NTS: ssdp:alive Location: http://[fe80::9bd:81dd:2fdc:5750]:2869/upnphost/udhisapi.dll?content=uuid:9319395a-4d03-4750-bb1b-4663933ab812 USN: uuid:9319395a-4d03-4750-bb1b-4663933ab812 Cache-Control: max-age=900 Server: Microsoft-Windows/10.0 UPnP/1.0 UPnP-Device-Host/1.0 OPT:"http://schemas.upnp.org/upnp/1/0/"; ns=01 01-NLS: d07b435d299b41784ca3d2ae2b959948 ( 9r[^l@:E#s0%lIM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9B[ggsGEY;@@}EG]sG}'DGS-1210-10PSwitch3.10.013sGB1QP0R1D9000025DGS-1210-10P}Port 10 0 sG@ 9[33sG`Q 0 sGQM]sG 0 sG'DGS-1210-10PSwitch3.10.013sGB1QP0R1D9000025DGS-1210-10P}Port 10 0 sG@X 9$[66Bp1L^ eE(+@1vස0sP+c#R'3P+e] ,~& &> i*dfmmiCK$pt)^ %=R * 3A }>  66 W  Q ;>5F K e/  L >m  _O lQ]? / N.=VIvwYtn _[I6^;BiUibi0sxt ; xtG1Z>xx,Y]lp% Q?Oz  XX 9Ơ[66L^ eBp1E(Rz@s0PR'3+c'PnWXX 9[66L^ eBp1E(Rz@s0PR'3+c'PnWX\ 9W[<<#`GE(@@]FsKypʚP /\\ 9[<<Bp1#E(|@@'sKyʚpPF\X 9[66Bp1L^ eE(,@1v߷0sP+c'R'3P+g=~ -cd d  L  G  @$489t5 P)$ #OJ= H a {  ] s=z@XrzQ l s,N*  q  o p@b (a N9 pN/"7}req?RGN3MQ>,G'  ee#\-<m-\ "hi a M h  gZO Pf s_+(\Cs-Nx!St!e<_X 9"[^^RE1?19lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9[^H$c1E;c,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9s[66L^ eBp1E(R{@s0PR'3+c+PfWXX 9[66L^ eBp1E(R{@s0PR'3+c+PfWXX 9.G[66Bp1L^ eE(-@1v޷0sP+c+R'3P+@*ju,4mjGY6 :K <(.y `rSz5+)c}@{ aI "sG gz1|A '#Lk9ws ( O7\40$!!&3B|:$Ma,fX-9=n H{b FI^q :$ C14 Z iM  /.b6(_z5 2t x3f9"i  !-q#w/f Xx 9[VV33 I27 63 `k RlY@ s XwR5 )FFc) $   ? N i RX ?{ 7R]B  B5'V  |hE PP\p RB6   CX| 9'^"[\\] cQbv UIb Yj1   Hods^ ', B'`gS )t b ci;3m@# DVUq#05  9 h ~u W,0kElt, a 0 "zAs'f 'H<;?Et5\+p ate .%y >9hXX 9&[66Bp1L^ eE(0@1v۷0sP+c7R'3P+M=I: stcoنt %3hA-TAxS7U4Po^Њ?#1D>GR [dmsT+wp"g|!7sLc O * ] xu V } u  3 `[ +G C~ j9 >  E % Yq "`8$'$dixյIv#8{XJr'!9Sat SbN1F`DC"Tp]](@6js+~b;VQn%l"Xht_R2b9zc+#D!bqb7/Htr:, '&>d|It6  C= b ͦ !!(.!L!j<!Q!%!!," "G "q"""##;w##$ $I$$Y$$$%9?%k%&@&55&j&&`'K''L(/(k() )g8)?*N**+A+3XX 9e&[66L^ eBp1E(R~@s0PR'3+c;PVWXX 9&[66L^ eBp1E(R~@s0PR'3+c;PVWXX 930[66Bp1L^ eE(1@1vڷ0sP+c;R'3P+q+,,Ou,,L,|--I-nN--..!.M.p .6..Ү./X/:/z[/*0900ؒ1b~112RN22^3$3m344Q4$4ٍ55L55756S6:I6y1667>S7q77Ǣ78&Z8K8{R88թ929f9::V::׋;/;\;;ř<"<}<<'=D=F=c=>><>j> >->? ?M.???\@@H@{@@AAIApA>A,BB2tBTB~ZB~BCC0PCCoDDKD~DJEIE=)EpE2EFFSFRF*G&G;|G{hGDGH H1HhH#HHH%I:yItIIJ^J3J] JJK\KBxKnKKWKHLLtLLEMM`MMЖN%$NYNN5OOg$OLP*NPPQHQQ;QR3]RRΗSS+OSTMSZSJS]TTLTyTTU"UHU`fU>U4V ]VCV@VW"W1WONWWW"WX XCCXXYY:YGYzYYZXZ\Z[:[P[\P\g\s] ]3Q]c]Y]^/^^r^5^1_6_U_n__``>``` aa@aeaab,bxdbckc.cXccdd RdAdqddX  91[Bp1L^ eE @3 vwTОA*?P/S b`0Ȍ&ZRYʠXPvb @ ݒ̴Ģ7] lg2J M LL dmC7x G UPMn.aʲm\ :yadL>OQx[v3U.a\׼haţP=cWXL*YMhR0Xr_$w4/~{pg;pa#\@s͚lԎ;o7͇WY-dne1~!EdЋ۱;jrz7żSqUdZ+B?YXֱ&[ʏ1IzgDֱb{3/Cc3NُT!qfOZOjVJb_4d0iztKz M?z\'/sO^*BlH0'k m˨<ԢeNZtTU~w S:pP ;ȱk/\]!z0wNb6#NYQ]1c [7;K׊p8=S1% nck`8s>1DYJмC%-.(xkz !ҥO@_2CH/585UYԍޚ"q^lұm=7ƸBs l 91[IIBp1L^ eE; @3wTОA*K?P\u`C$ 6G=?s{+sk,qG8D@(+&}AӸU)(CFJb9Gw5o}ʒ eIJ,GUKZoC)!SczPnəw h2E72zܖFC4*k&ᛑ+4n|I E 7JIfHY>k r<~s[9C4~(Š`2 YG(\l\ 9Ύ1[<<L^ e`GE(IU@@ȂwTО?A*^Ph^\  91[Bp1L^ eE @3 twTОA*^?PY sTmC7x G UPMn.aʲm\ :yadL>OQx[v3U.a\׼haţP=cWXL*YMhR0Xr_$w4/~{pg;pa#\@s͚lԎ;o7͇WY-dne1~!EdЋ۱;jrz7żSqUdZ+B?YXֱ&[ʏ1IzgDֱb{3/Cc3NُT!qfOZOjVJb_4d0iztKz M?z\'/sO^*BlH0'k m˨<ԢeNZtTU~w S:pP ;ȱk/\]!z0wNb6#NYQ]1c [7;K׊p8=S1% nck`8s>1DYJмC%-.(xkz !ҥO@_2CH/585UYԍޚ"q^lұm=7ƸBs\u`C$ 6G=?s{+sk,qG8D@(+&}A  9?1[Bp1L^ eE @3ewTОA+?P.ӸU)(CFJb9Gw5o}ʒ eIJ,GUKZoC)!SczPnəw h2E72zܖFC4*k&ᛑ+4n|I E 7JIfHY>k+APƬJr~)ҁ~`g\ 9Q1[<<L^ e`GE(@@wTО?A+P4TTP/1.\  9y1[Bp1L^ eE @3 rwTОA+?P~?tTmC7x G UPMn.aʲm\ :yadL>OQx[v3U.a\׼haţP=cWXL*YMhR0Xr_$w4/~{pg;pa#\@s͚lԎ;o7͇WY-dne1~!EdЋ۱;jrz7żSqUdZ+B?YXֱ&[ʏ1IzgDֱb{3/Cc3NُT!qfOZOjVJb_4d0iztKz M?z\'/sO^*BlH0'k m˨<ԢeNZtTU~w S:pP ;ȱk/\]!z0wNb6#NYQ]1c [7;K׊p8=S1% nck`8s>1DYJмC%-.(xkz !ҥO@_2CH/585UYԍޚ"q^lұm=7ƸBs\u`C$ 6G=?s{+sk,qG8D@(+&}AӸU  91[Bp1L^ eE @3fwTОA+ ?Pq)(CFJb9Gw5o}ʒ eIJ,GUKZoC)!SczPnəw h2E72zܖFC4*k&ᛑ+4n|I E 7JIfHY>k+APƬJr~)ҁ~`g\ 91[<<L^ e`GE(@@UwTО?A+ GP\ 91[bb33{ ކ`,{ "#,{ 28k&qit 9 2[QQL^ e`GECU@@ wTО?A+ GP!ԎtX 9N%3[66L^ eBp1E(R@s0PR'3+c?PVWXX 9}%3[66L^ eBp1E(R@s0PR'3+c?PVWX\ 9{3[<<Bp1L^ eE( @3$wTОA+ GZP\ 9{3[rrL^ e`GEd@@wTОZA+ GPq!4$=͏-I^ðN%ӟ b 3iJ n ܆N 9ږ3[gg\٘EY@@n~ n@E81\٘ n'DNS-1100-04NASUZUZ=[UZ1.02b10x\٘3A1dlink-DDF5F3 nLAN1\ 9 5[<<Bp1L^ eE( @3#wTОA+ G˖Pk\ 9 )5[^2,E,H_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9-16[66Bp1L^ eE(2@1vٷ0sP+c?R'3P+'e:eefkfAff=fgg^gJgh"hTWh~hĠi0imi)i{j!^jHjkjpjk&kWkSkl\l^lmLm'mmbn$n[;nnoIoouppNp pֱqqX^q8qrHrQrs1sBsEtO#ttuQv vv w0wwxSnxyyw:ygzEzz {81{{|Di|}!}}~8p~~Ś L#=fh9})W'P5Lٰ J~/@ pe&#xWq!ZX78S R sq_%0stss^+O'p 9dFNw t  @ i S C z  I | {9a ,/cz+#wT:h.sZ)$edtselstDytrak\tkhdӑ"ӑ% Xd 96L8[DD^E6S7%""2notebookd 9wL8[^EU/%lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9?9[66L^ eBp1E(R@s0PR'3+cCPNWXX 9?9[66L^ eBp1E(R@s0PR'3+cCPNWXX 9:[66Bp1L^ eE(3@1vط0sP+cCR'3P+n@yKmdia mdhdӑ"ӑ% ]mU3hdlrsounSound Media Handlerxminfsmhd$dinfdref url xstbl`stsdPmp4a],esds@x|VHsttsw4stsc  mstszw!XX 9X=[66L^ eBp1E(R@s0PR'3+cGPNWXX 9=[66L^ eBp1E(R@s0PR'3+cGPNWXd 9 >[DD^E6S6%""2notebookdX 9if?[66Bp1L^ eE(4@1v׷0sP+cGR'3P+iZXX 92sB[66L^ eBp1E(R@s0PR'3+cKPFWXX 9bsB[66L^ eBp1E(R@s0PR'3+cKPFWXX 9yE[66Bp1L^ eE(5@1vַ0sP+cKR'3P+b=XX 9{E[66Bp1L^ eE(6@1vշ0sP+cOR'3P+hXX 9e|E[66L^ eBp1E(R@s0PR'3+cSP>WXX 9|E[66L^ eBp1E(R@s0PR'3+cSP>WX 9RF[^^RE1@09lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 x 9UG[VVL^ eEHqwCD4QG11wcSc56w3<w__x 9HmI[^H$c1E;a,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9tJ[^E q1luM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9 K[__33`) /WP8) caesar-thinkpadl 9 K[KK^E=y18): caesar-thinkpadlX 9^N[66Bp1L^ eE(7@1vԷ0sP+cSR'3P+f4X| 9O[\\Q[KK^E=y18): caesar-thinkpadlX 9{Q[66L^ eBp1E(R@s0PR'3+cWP>WXX 9Q[66L^ eBp1E(R@s0PR'3+cWP>WXX 9#}V[66Bp1L^ eE(8@1vӷ0sP+cWR'3P+_XX 9KY[66Bp1L^ eE(9@1vҷ0sP+c[R'3P+_tXX 9fLY[66L^ eBp1E(R@s0PR'3+c_P2WXX 9LY[66L^ eBp1E(R@s0PR'3+c_P2WX| 9-\[\\6`[@-oV5wKߛH=P3-`3>2_iVT DΡ zt)( XnAWn,,[#uQw;wNr} 3nkwu|yO!N%fP˶&4<}&#Qo)9-0Ԓu=,Oi<$0 ȊbaLS'ҿ4oOoWwgr8)RUe æ?8a\#9XQ%2|J>;/Sl#*Y5}ݥ@FEgg&ix oj.AFNx2f}hf;f&x)Jt̓W BIoFH޷ksT,%PŨ KL"rYpfɥ /}t 9G(Llwc sU݀Gʭ)jzg !L@7(Rjym:u w>ao:L7 beKׂpJ`MEЎڎMDPo xPȢ(6o%gOZGNrUt ,!q , >m.Lo}?G1Bp 9e[NN#`GE@@@rsKz4  Bp 9;e[L^ e`GE钣@@i W$LRq30j B_%&,er,/,m][MW@#0->U-OA ypM\[(\pX˨#h2peYwⴽ(ŀUap +賹vswoߜ6G= gB l$GQU6(&S><6heH޾ êc$c2|"їJ 3/SԱ :MW(Yu&bMZAt 74.ϝp.Y8ŗKʢ=#aT*])5UJNޜ9`ֶk-*R6&:k죶:v8 pteQ.@鎊 +klV9ڧ4Cދ.P8~ R$2C 2vCO T"R8@̵ ]8xFCxB%p_#ajf_G v>DX7nÕxKQʤ1ՠc"wWI7]RI[gB%e =s(OlgA1Iq ~|VȞzA >Gԁ ) <+9/yll܍8d]3hkV7v7ht|ghNX 9e[66Bp1L^ eE(;@1vз0sP+ccR'3P+SXX 9e[66Bp1L^ eE(<@1vϷ0sP+cgR'3P+PUXd 9Ve[BBBp1#E4@@AsKz$W4 dd 9ve[BBBp1L^ eE4@X# W$L0Rq3,M _Bd 9e[Bp1L^ eEy@X# W$L0Rq3Z _B@U(Yz ԓ ԸQW㔀޶-os*?t&vfk}\ 9e[<<#`GE( @@sKz4 $WP  EJFDE\X 9+e[66L^ eBp1E(R@s0PR'3+ckP&WXX 9Ke[66L^ eBp1E(R@s0PR'3+ckP&WXd 9e[BBL^ e`GE4 @@ W$LRsuT G_d0 9Ze[#`GE,@@@sKz4 $WP }W_/P]A-"ݓ9 A$vg c IU*H %%%E`-{JVd 9Vf[BBBp1L^ eE4@X# W$LuRs ) _Bd< 9Pf[#`GE A@@/sKz4 $WP ABх U@TG@Z[c9hrh$U&r^ۂ+}O%z=H@jF3ûV]%Y.[KeG T|h i %8.6  f⎭;-}\eKY('vkn Gkq=j<ҿUٽ \g^C'!||`5ډ+/Qɧ]3*2WLOrY=b7+ *9Asf-ӋFh?̥͊qTɯS->Z,&DTG{V&k_|Ps70jq^(%ANq/:Qy+0opk"pcڂZ,nG 36M fI/p1{ /qDF%P6B5Lھ]PBA%z&U.::fķ S*ɑH""L$Q,l ߩ־Y0`2HT =t {"Z}#r-hds`B6 GTyk[nXey tnPN ~s_;j܀`0Nbb{!Sܹ2`U:~_'rcn< 9f[Bp1#Eq@@:sKz$W4 PFpU.}Kv9VKl*E>yq#[iHKZ05Igs~[xF^=5=nJe1e13?1' .nCI av(tP=UO‘T{b iX7GcT3K+:ll(E}x{Lyϫo8l=VIZP'P/>B;|mLcǫ72ۋ h\ 9f[<<#`GE(f@@lsKz4 $WP\| 9Tg[YYL^ e`GEK`_57\mdl-obsofficiallinenaverjp|D 9 7g[!!Bp1L^ eED|_5'mdl-obsofficiallinenaverjp LC-dl-obsofficiallinenaverjp edgesuitenet;5 cac-dl-obsofficiallinenaverjp line-zeroakadnscta1867g2akamaicEQIEQB=>Dp 9=g[NNL^ e`GE@C@@^-EQI{P1 0 p\ 9f@g[<<Bp1L^ eE( @3"wTОA+ G:P\ 9@g[L^ e`GEtfm@@wTО:A+ GPZ#Dm;8 GŹn^4NHIWUe~9KS]߹v`\ߤxe( IԫX^C՗kt܀ʡt.m0I"W"sA2XxBkwd408ҚT5 ʂF2xPm<8#Iv_əᴟr4rl߱m4nhpe!xˈtxgo;]oJ 4:g&OAg~_N3 ּ4֕oB꿾xt领LX1Bc35{;)v=7fQi_^13p 9uAg[NNL^ e`GE@@@@EQI|PHT pl 9Jg[JJBp1L^ eE<@;]uEQIP{R1 Ϡq 0 ]Fld 9/Kg[BBL^ e`GE4f@@EQI{P1 ϿR^ ]Fdl 9Mg[JJBp1L^ eE<@;]uEQIP|מѠq  ]Gld 9=Mg[BBL^ e`GE4~f@@EQI|Pן5 ]Gdp 9Pg[NNL^ e`GE@\@@EQI|Pן ]GGET /r/talk/m/4697716971500/preview HTTP/1.1 Accept-Encoding: gzip, deflate Connection: Keep-Alive Content-Length: 0 Host: dl-obs.official.line.naver.jp User-Agent: DESKTOP:MAC:10.10.5-YOSEMITE(4.7.2) X-Line-Application: DESKTOPMAC 4.7.2 MAC 10.10.5-YOSEMITE pp 9!Pg[NNL^ e`GE@N@@|EQI{P1 ϿR)g ]FGET /r/talk/m/4697716954688/preview HTTP/1.1 Accept-Encoding: gzip, deflate Connection: Keep-Alive Content-Length: 0 Host: dl-obs.official.line.naver.jp User-Agent: DESKTOP:MAC:10.10.5-YOSEMITE(4.7.2) X-Line-Application: DESKTOPMAC 4.7.2 MAC 10.10.5-YOSEMITE pd 9eg[BBBp1L^ eE4@;ҨEQIP|ן݀A ]Kdd 9jg[BBBp1L^ eE4@;MEQIP{R1 ۀ˶ ]Kd  9Uwg[Bp1L^ eE܊@;EQIP|ן݀ ]KHTTP/1.1 200 OK Content-Type: image/jpeg Content-Length: 7542 Expires: Sun, 29 Jan 2017 02:12:28 GMT Cache-Control: max-age=10368000 Accept-Ranges: bytes Last-Modified: Tue, 02 Aug 2016 02:12:28 GMT Access-Control-Allow-Origin: * Access-Control-Expose-Headers: X-Line-HTTP,X-LS,x-obs-oid,x-obs-hash X-Content-Type-Options: nosniff Date: Tue, 02 Aug 2016 02:20:15 GMT Connection: keep-alive JFIFC (B+(%%(Q:=0B`Ued_U][jxjqs[]gɺǙC(#(N++Nn]n"?!1AQ"aq2#BRSbCr3T4(!1QAaq ?@ *T\W\p% Zm4WWSk4<Mqq%LYb-ȾV\A\ V#Kizχ;b-TMF2fr2I8Ti <2x8\0Cܽ@F1m/}ڳqX%„8eRrI4joK 5y5V+v}7s4i HqeĝEG9ak[xܕ]diL*Q'fE7F̬EÐjKi$ifyyi:15S<yԟҞLV-tTЏyI7T|:Gѽ)m'RXE*X"L{{4BMηP*n)39dl5Zd[72c&'PPr*UdPq¤Jc$;SY{)l+YIҶlKiVY-k671h ^~4e#tC_ҠcUQcWu4b]llkG ry$OvQJt8DP8.&,Q 1D{EH̚NN:N i$H1;?BUAǚR1"FUNEF6,"ޭb)AQ:2j蠁.Qf\P\U)2$d?T2&Q.1*X*|V_5Gu'MjMZ@ 偟ƤK̹FެѡJlc['cǗ:Č͒NSn_䰘>XwEzQԆ_@qK9jӽAmlAX]@Uv(Af2L +DŽ΄7$<҄_ RO<|*hWq4w|75 LX8$VQ aDX<8zYz$>I]i [eE%>UӒ:n FI=nJ"O*oר(ƌ"Uࢢ//P   9wg[Bp1L^ eE@;GEQIP{Xe1 ۀ ]K*h,3GN%Uf>~uu{6g\3dpJ:ѩ6;DW"BBw!W.|3ʾI40=$މd#;|5]7t4Xk>陓3¢kjc/̶m*?O$Fc'Tp8yցd7c,g<7YW2Kj*j'oKۦ7@kߟt>Su\ /[n<+7|`x4ݡp$8N⣳dXc<+nے䌲Rz4hh(]RaN* ի&րP\SM38> C:a^ΕCvTqX:#]USETќclC"-\-\-[Ip؞F{uMmsR%S/xGBN$;:xK*.cxTg(ܿvH%\QhxD;CY3g)ynA2:029) pXAbpP4[<Ē,r::*YSO?z|6Ny9V Hy") 3HqWXuvuJnϥ1_(.L&Uu)x)8g.?n g`iN#O@W-ߏo',!χe89'\FSpDzƧ Ƿ (םi3B[ptҕ $w1vctWr?_/ EC3mMԓ>jUFNBebh2K[X@Пu4bWQ91hl7רK󭂵\8fn48/wi޴(8Ɂ%NW !'I-+XFŲ5XUP0EfVLfh0HC8] NMJ!N?{S} mv`瑙lYT;3Gk. H{kG0̽r5 qLPe<^LaJᅗ1mwh#9 u hw'BrqP~k_;AWR }JŅic{ F%Z,! t|kZv&9Q$4d8[qoQ*Y{%u0xi8moC0`m4r.eĘH f12g`-`H/bMڌp 946Ue9cΎC2.'+Tە?v2 m>b:U+RPD'AYAzԚd3_U&<ڙZ=نEy}ysHt2ز^>嬷ܲ}oYɋ)EU[!{X5rMUq &p圬nd=64!xr|˥N$u!5!+f   9wg[Bp1L^ eE܊@;EQIP|݀k ]K&`,.nvklS'LJG 5LA-še>ۖkWq`-1\I.)h^\HN-A2 01/*ہVJec otfڪWȞ#_8^qnȋ*雒X֟؈͎:޲S&!b'l j/ccTBX!RI>V`FF3*/&luQmttzi*iK(\2h_MWT@e x[[f%tYhTiGܱ$$/GZVJ-Ng%Zˑ`>k;#d5m+7z νcPOYǍq H8n ҕlHOo_{o_=gScR\ 嗌"{'R8Vb3uVAcqzYo^ XE/ ǰ-Ԗ_MεpeȮl]ط|> UQ&k_fQZ. _.3o?zP3~љ"ʤACju6qG`?u>W%N( (0h1B؈VO5!"1hkliLQbxǬdm]i4u))PrSo?Sݮ_qbrF^T+d&<ʜ5ِj15HII8 L TI5Y L$ؕ`ljbuP$Xǁ3V)4,i˝/l>mZRk"xwOgU[J2Q   9wg[Bp1L^ eE@;GEQIP{^ 1 ۀgl ]KتH3]zZCSa }(=5]ә@pFv#ƶ! s:Hl1 ~|hv2,nd\$0v,mNмH2K.xmyߎզdfx8C'Ҋ6Ǖ*kёڷ3)s7 (V*=#ڶm rMS" y"cP8QA{Fk 9GId ݱvBNQu\?#vzdI0ޣciFc<;Vӣ4Վ}]W_?z|1l\vy8Ξ O﫯oԱ ?:i#ҊƕwLO(Q\iJ^, -og2GF"E1Qujm|{9ӟZbRFCH`@kҘg#= @өFF?tsZkio[֊byz:]M[)?yݣ38;}G²ĭ_zu[Cn\B'>\J# >U} 3+0'Nw5Nc{_XJ4ķkjuw~Ttufe 5/9{fiHQ%F>~S!KיRzxfhw-lV#&ޏÍ-{sCU> Oxer1u #'=4m1es?ud?QH= *k}waޜ]41j7,,r28X8mB5|#=|hxq7/D6eQն;b u hՌqxYbQ~`66=?!U7Qv+{gKHۥ~sy[QKin z֢ٓQHJ~{@5+,ݖ%p0FǓ6CdUH`UJ]qU zFqTIVMV|?P\Ǥ2@)4(sqYM!] ear7e:';Yw4SN˜(6C'8j唛5b '::m/riB#[:H9%GJ=q#    9wg[Bp1L^ eE@;GEQIP{c1 ۀ( ]KΜ\aDTTtTc, ƏRpM;gj皗r4y)U IL) ҂ $#nUd[V>rX Iہ9(l7'nhG4#ZiHb18Ǟk$4`Iޙ\ygoKճu\#(yǖ],<##Ds]ݜw.'9Tw9 ںBAS3rp7ߦE-d)ͭ&ӱ\mZ/c/ͱIM F8#4xPlGΟʳ{B;++@>@k4kYv>Pp=_?svѧҽҲk(G'7j] ِY")tVƑ tk=B~ *Kְȭqb{YU"x]/ :1,t&Iу)^ rv}d*q11\4Q* wǡ}*_c=GQ]) jثHBY]N۾ՙT1ȁѸTIZ)ݾaXTUD&Ó[huBGPB[VMh̤gߧ@L$nA*@AexUA䡵s >ɂ .A3_!thmb[98ztPt8D's1w*A7ˈHXNGAϽ kiH ח֕iW*᎐@hn[ v}É ؅r;{>KIfY@: za݊?SG"5+# . 0xxZO&3=}͎ gJټOڲWʈP9 RY-۳V즱7wF7O?rB7 N\rCԏ҄aMjɘ_ʡ]=G{M|s>пZHPxMTM/[ Hyԉ~4ni$l61wOLg{7cgLPX uVUi ڻt,z\M{pXn۵HT([M 6x16|—B0X%ؑ:R0d܍®љG(W6گ/>Z" ؿ4XĈ\] U#9S- YZ䋋bT\Gb;ڱ҃$i"FuO5U`g)Γlq*,A3 ^ϵgmkeʗE Pag8LB,ZbF $ 9{g[Bp1L^ eE@;EQIP|݀ ]K acex"@-el ڎ Vwn~zYQ]%<v5r2$009Rס`ͣ6xe2fGRI?*+Ԩ(<2{RG9s+|3W& o^ 9Xfw,LTbpAHl}^Ѩ9^sDP R$vt\,#P{]]E.Eԯ Roofty1R.IC;UrEIT^CSó8FF%_,66A{D^"v7vbf=h4RDLT`K)"gffhOtk^zpLN'DʓM3*Hir_uW=k=hPH(1<HFjc}*r^/pxf q{략TUǰY+bP{F)*@ k]ZZ((#e!?dcE$(AA|3&|3;A#NZWSsֽs֊ 9(1 OgwB6bQKH6,vMZ(Tq}a@MBb8EoRv5 fa1aVl4,db5\4i$-`+SAy0NwoBM6%a0o Pf}Mw4PQ$d 9{g[BBL^ e`GE4DA@@<EQI|P ]Kd  9|g[Bp1L^ eE@;GEQIP{i]1 ۀ( ]K0B<<3bc'&@@'K+ = 4g45͏iPZ)@ Vݽ:(vL0Eevtq+o>=VJDrM$K9erKeXA9v̟'U[^6}XضtW].22]'I|7Q1 Q0Rk>7^Ug;r~xjL8?'?z; o,IҊHsʱ; -3 F<D ٮ)6xyX5lP.rrpI%'oٿ9td"`AUʗP_Zx{BHsǕߡ٨^")1N߭JZlvx|I$HO$` 42;esNm31#Vχlmp+>FGjƍ#B߳r ޯ9x1kKo*?~OxS1>5[a+u 6HUⲀe7=֢hpl7Gp,ٞkcz = Kݻw6xnǥd/08 s*Dz&I,~k 5! ,oWnѶ[B8Ի ]9iN<'p9>Sffm؛fvD\lFJ{iXg8~?&C`1]COZc>yN a̐PP;ނ9nW.glڠqxW% 0~#|?* 5ϫW`$qT$αơ lc,2{Yʲq&ڃ5X 0otcnێHmb&=Ԓ#ҰD:BV!>&NFVP;CHHF16Z9'|7|hd g*%ƚ4Y~Y qԅ):dYIW mYm"- |OdD8IB푞^tpݜYkF8–൞an i dYkX^6 FYss|Q!*\^#uhrm!!708ffq, 2:O-Wa^AG01 >/\UrW:8jPc)o{ֻ\3KHi8Kɭy7~ځ>t+ɦXm_I'N']z. ۨ=Ej\UZЯ&a,"ǎ滊((xd 9%|g[BBL^ e`GE4EQ@@,EQI{P1 ۿs ]Kd 9^h[Bp1L^ eE@Xk W$LuRs 9F _BVt/W~|s: K#Rn7!&E :mA/(%=;ɤ=kLb% !)̡X䧀R_^s'RCC};QmG&WY5Al$Mg9~hT*- *0!\-Rqx ={ҋrb# 7&&M4^Ʒ[Vk(D:9ʥ9]Z3I AuּZ ЫpHS6}Τf4Nn^n1XeqAUxG\,(\[0ኛ A{Xf%}=%Mݾ}%׺䑌}%5ɌЗͥu?Oo t÷R*x6LJ^S%\ڝ[ TE<vg,|# 2R)L4*CƏds%qE&UH Mv~Jq`7nn 5 R}dVq1S*?-\u¡]T7{? !O w:jZTԹ?iŧpډ\{:Qpa0G> \b` |-@p5A`nډ޾F XAK]X) c$z0<;Qf0<0pNn1lr%9d:OJ'\M5ُ1cxԏԩrp.(=+@1(,s?V4 G*%N)]%\q~zAc#<  +@'jK^)%ꚺ@W>,sy"ze>dFjQl33C;-V^J SD]u,'EQNQJvSQ"iBk;{< B\gp^dz?tYG-Q ] x{)z闅mb8` x)ySxs' H)$)D)[>Ki\VN=0ƢC7XU/6p0tO|A|Ozaw9AIʖ(bf@#w)+<y=T;gϮmJFTB`s,&uE|3@3+dY|~\HI?o dAsA"Fo”RBߠppsdْԂ9sK^weec'zpLjH^|,_|7顱O;KL}^M_4#7z_[; ZQ=dE٪LxN )hAwl=ǏG{|5Jg׉'I׼xٲGc9oσ dDE-X 9^h[66Bp1L^ eE(@X! W$LRs  _BB7l XHV.u3!HΟy_~\3zja w2K|\ 3 {o v™]L>8[ؿix=͹cefrYͨup[nMq4fKYY&e[/uZ^wB4մ4KeAj51ӍᢀQ {mpB>kOAIx߷^~m.[*\x hkw2ކ,:t|e뒁@t.)pUR#R>\K)i1r,Hu #~WjV^ާ iih Y/'u %F=Z% NTd!)`WJaGڴ*R9vl9 ԯ:A'?esY3A7 LW?2ͿDRZ@ڱ"XXd 9?_h[BBL^ e`GE4@@A W$LRs߀ _d\ 9h[<<Bp1L^ eE( @3!wTОA+ G͆P!u\< 9:i[Bp1L^ eE @3;wTОA+ G͆P!E0!#b`p){ݓUG[# @j,%$* U,p82mNK௾E ف#zl@Q+A}~(m\;|ֽuI;^4^5|(F}+@xKYSJ6Pcc; (M#08J _ S~ Cl'ctA-DgH{$@Ypr~ϑ[4^lﺽKoR{Xfs:ԘYjYsuSzUб(p?up5hW'l5#>m{iX>n{|9>|Db|pմ@1tNVIyFB+iX<,Hru.TC#{5ڙ"H*{.vgAͧ<\ 9C;i[<<L^ e`GE(c@@wTО͆A+ ,P \ 9{Kj[^l@:ES0%lIM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9m[66Bp1L^ eE(=@1vη0sP+ckR'3P+LXx 9n[VVL^ eEHqwCD4K CD\--wqcSc56w3<w__xX 9|*p[66L^ eBp1E(R@s0PR'3+coP&WXX 9*p[66L^ eBp1E(R@s0PR'3+coP&WXX 9s[66Bp1L^ eE(>@1vͷ0sP+coR'3P+GXX 9v[66L^ eBp1E(R@s0PR'3+csPWXX 9v[66L^ eBp1E(R@s0PR'3+csPWX 9Sv[^H$c1E;_,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9w[66Bp1L^ eE(?@1v̷0sP+csR'3P+BXX 9z[66L^ eBp1E(R@s0PR'3+cwPWXX 9z[66L^ eBp1E(R@s0PR'3+cwPWX 9w{[^=E@/kldM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9s_|[66Bp1L^ eE(@@1v˷0sP+cwR'3P+>$XX 9l[66L^ eBp1E(R@s0PR'3+c{PWXX 9m[66L^ eBp1E(R@s0PR'3+c{PWXX 9,Q[66Bp1L^ eE(A@1vʷ0sP+c{R'3P+:TXX 9S[66Bp1L^ eE(B@1vɷ0sP+cR'3P+7XX 94T[66L^ eBp1E(R@s0PR'3+cPWXX 9LT[66L^ eBp1E(R@s0PR'3+cPWXx 9S[VVL^ eEHqwCD4[Q*  wp*cSc56w3<w__xX 9[66Bp1L^ eE(C@1vȷ0sP+cR'3P+3Xh 9å[EE^oE7'ee!f#NY Joanna-PChh 9[EE^p*E7  f#\gY Joanna-PChh 99[EE^oE7'ge!f#NY Joanna-PChh 9D:[EE^p*E7  f#\gY Joanna-PChX 9Dz[66L^ eBp1E(R@~s0PR'3+cPWXX 9[66L^ eBp1E(R@~s0PR'3+cPWX 9Ώ[^oE'h| e!ؽlbM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9kϏ[^p*E  ؼlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9Ϗ[^2,E,J_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9uǑ[66Bp1L^ eE(D@1vǷ0sP+cR'3P+.PX 9'[^EW-%lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9Ք[66L^ eBp1E(R@}s0PR'3+cPWXX 95Ք[66L^ eBp1E(R@}s0PR'3+cPWXX 9R[66Bp1L^ eE(E@1vƷ0sP+cR'3P++aXX 94][66L^ eBp1E(R@|s0PR'3+cPWXX 9c][66L^ eBp1E(R@|s0PR'3+cPWXX 9[66Bp1L^ eE(F@1vŷ0sP+cR'3P+'XX 9J[66L^ eBp1E(R@{s0PR'3+cPVXX 9z[66L^ eBp1E(R@{s0PR'3+cPVXX 9[66Bp1L^ eE(G@1vķ0sP+cR'3P+#XX 9[66Bp1L^ eE(H@1v÷0sP+cR'3P+ /XX 9[66L^ eBp1E(R@zs0PR'3+cPVXX 9[66L^ eBp1E(R@zs0PR'3+cPVX 9[^H$c1E;^,ȽlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9z[^E o1luM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3  9 4[bb33{ ކ`,{ "#,x 28k&qiX 95[66Bp1L^ eE(I@1v·0sP+cR'3P+XX 9 C[66L^ eBp1E(R@ys0PR'3+cPVXX 9EC[66L^ eBp1E(R@ys0PR'3+cPVX 9M[Bp1L^ eE#V@XB WJn"_ŀ" 0w`8e-e87 2ug3j(`YoTR#K`2P04||œ4I0LcL-01Au/|d 9N[BBL^ e`GE4@@S WJ_n#Cյ ѝ0wd 9M[L^ e`GE@@c WJ_n#C" 0wtC[r V2O nTX0 gmqn=>kjlFXI~D^G=?_~4ta63D0O7vnk#w3z{gqKkޙi554"7r L˷,<6؈z!zWm4T?3/x- єL:X8>[cu1jiܼ.)rs7 G6뺉OJ3'e*6o .jdbۈ!^gD5QC7:gW7GD:Ҡ mx^px]Pʣy?NF}jT\xdNͷig,03'A`t2N;$p:Ot%؆ ?ؾtg}yhP]_ f DwdL2hp:聺IeiG(Xo} U Wxo_6l]'Yg#\qCqj;Bt9ڞaU^ nrlCZ}YzD mIC[b w0rRiԿ }pV+TGY3H/ږC)b,+VWB-sF  <|v؇cîW\~,i"ᒯ$(SUJy.0 DM~M̞%w{ N7o5bQO[,{ jуd,l4Z ӟI 0)y+uH6Fxʚy6򂦐Drh=)Be)ك{6A;|Y5?)Wp67z=O:ػVEOh_5O<]qyH#Zk+ 9! ;B,x1GY,SN#ǴCgcghL=<:yrSF ]U6&'8rJ8X~{睟#TVjA+l73ES`-6 ЈukŨgJ\ʝX V|?Y Z$J2ȧf((wm~myyc3)|'4{@(Č [au# *-I:'1"3d 9k[BBBp1L^ eE4#W@Xæ WJn#C_J+ 0dX 9PB[66Bp1L^ eE(J@1v0sP+cR'3P+X 9a1[Bp1L^ eE#X@X WJn#C_JrM 0l$3.MHZV6dOri g0:{o-pwGd"&2Eu-ߕ17+X[z@dr`kh+#QO.p0{i ~WBE`UzFvM{bNМۥGGedpFL<.=f$P/2DMXB!lbkCt"=9+ c ӠgTM=ta.\pgꎚG ʝAǚ6ϓGC3bwRnr7"/HI9zf5R[ 0yҙirX$KZNdYJ߃"jy˯\yBy( m&١hz=@BQvLd 91[BBL^ e`GE4n@@M WJ_Jn$؀ͱ ϝ0ld 95[Bp1L^ eE#Y@XO WJn$_J@3 0lPC"6*`}ŠA`t>ҸR AePǬr3:oT6Kxv33U`ّd 9!5[BBL^ e`GE4r@@ WJ_Jn%-R ϝ0ld 95[Bp1L^ eE#Z@XN WJn$_J@' 0xPC"6*`}ŠA`t>ҸR AePǬr3:oT6Kxv33U`ّd 95[BBL^ e`GE4U@@O WJ_Jn%-B Н0xdX 9M[66L^ eBp1E(R@xs0PR'3+cPVXX 9M[66L^ eBp1E(R@xs0PR'3+cPVXX 96ش[66Bp1L^ eE(K@1v0sP+cR'3P+XX 9[66L^ eBp1E(R@ws0PR'3+cPVXX 9[66L^ eBp1E(R@ws0PR'3+cPVXX 9jj[66Bp1L^ eE(L@1v0sP+cR'3P+EXX 9u[66L^ eBp1E(R@vs0PR'3+cPVXX 9.v[66L^ eBp1E(R@vs0PR'3+cPVX 9@[^oE'l|e!ؽlbM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9ɟ[^p*E A_ ؼlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9١[^2,E,K_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9nj[66Bp1L^ eE(M@1v0sP+cR'3P+ XX 9ɐ[66Bp1L^ eE(N@1v0sP+cR'3P+i stcoTwT+e9 L2p%eMM,Ilh#Drk3)6j@ JoT[XX 9X[66L^ eBp1E(R@us0PR'3+cPVXX 9[66L^ eBp1E(R@us0PR'3+cPVX 9[^EX,%lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9Vt[kkBp1#E]@@ ] N  RQ | LDX x>a|BNLQw׊C*c2L0sL{7kY )X}}~Li:Bu9,cc$wP&6JngQ*5Q,m0!c*Zst<[^E(NAqm%7k]u &I/Bmf R ; [S ze T !! !D!b!*!!ſ!"X"?"j""P"O# #4#x>#$W$BN${$$ɭ$$%2 %d%& &-&c~&P& 'D'e'((9(d()w)_)*G*w*A+9++,,HK,,,7-X-B^-f--m-;.[.FG.h..Q.c./ /3/s(/020x011[71d1<2J223&3fs3h4 -4J04}4>5 5E/5y855X 9' [gg\٘EY@@n~ n@E81\٘ n'DNS-1100-04NASUZUZ=[UZ1.02b10x\٘3A1dlink-DDF5F3 nLAN1X 9[66L^ eBp1E(R@ts0PR'3+cPVXX 9̿[66L^ eBp1E(R@ts0PR'3+cPVXX 9X[66Bp1L^ eE(P@1v0sP+cR'3P+Wį5626q6/6B767i7D7=7C88Dv8s8>8E89_W9j9e:Ou:O: ;;Un;C;A<@>5W>c9>>>R??E??Z??9@Ae@tO@@DAABSAi/AABB+6BLBw BCB}C7C(CCDDDD$DDE5EiTEEgFFKFFFG4'GtGG~HoH*H`H}HTHHI3 ImaI4IIJ, JUJJJK;KfKKKLLm@LiLMMYFMdMNNQNMNOiO_OP"PP݆QAIQ~[QQR,RR-RSS#SLS SS/T TETrTT9UfUAnUXUUVV<V{VPVW*8WGWWuWW-XHX<XTXYY@YrY0YZPZZ[3V[[\I_\$\] ]+]\]]^(^k^^_/<_NX_gy_w_Ҟ_`6`{5`d`afa9?a^aa1b%bpbJbc'c cOc#dd:didde3eef 0f:.fLff7grgWggІhmhMh'hOi)Zif|ii2jj@jdgj"j|kkP+kk[llVl(l m `mbm/nnSncnܮoAoxoDoXX 9/[66L^ eBp1E(R@ss0PR'3+cPVXX 9a[66L^ eBp1E(R@ss0PR'3+cPVX| 93[\\rzzz{0{q{ܣ|=|N}}w}~19~~~<D@u6Y&f2}u"P>}jl I.wTBv+^iqSi>Qp1yzlŌWW~ic!mdat tx-video-4.27e7ZDة#řB nc2Zi!fĽk$7;4~{tgD9X&v8<5eB`嘈XjsgzlY}{GXzy둲!(SlOm:.CK Vc{DHc>[#AV[ЩޜEAD߮d. ,oϟKELrPpc=^4#Dj?4J03.6.$ۯ&r:.J- [g8}3x/ݗ݇l@DQҗT^NT&&wGw޽_3ntNnXߪ1%`NmuO(Iظ. A!/eC+sUxAA_KoA `/+(Ab%!-8& zX4لP+;>4A! z@_ >sHXX{~}\-cA% cXHOvX#P޽7RC.X 9[^E n1luM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 9e[66L^ eBp1E(R@rs0PR'3+cPVXX 9e[66L^ eBp1E(R@rs0PR'3+cPVXX 9[66Bp1L^ eE(R@1v0sP+cR'3P++m CV+uFRVR`Vp@wNfJrAá$ {D>vEg]z,40{J,$ A$ Lp D~lARF&l2Yfק.ބ <B.8%i9߃Qk(7< "jvS g]}yu0%L q?ז *AXp e6\+,$/%lV A%:/!Uefz x!@|p >uBEw@`!@|p[4|Z8!@|py>uB=HTF!)  cB"n}GTc`1`Nb@RxΟeuǞu낂`1 f2C+ȭT[5y9*&þ"u:9Ud0|^W{ 6}2?UcXɍi.:1 "פ& !KH@Uy>OȢwQQAF;6xZJ״+)H jxE]0+wpl_T|$Dt̠À:m8$`|mdy|mܥ:g~î ⌊8G`{c{BKg)4xxahm绸6Q60`@@!y Ʊ:TJV١UEv3BJEkba-sJ9_wKg%QOy uyXO  _ۭRQ=<& @15lw"gԺ-am~v <^~gixtm2 E(e76@|x>Q?]>Z`XX 9[66L^ eBp1E(R@qs0PR'3+cPVXX 9+[66L^ eBp1E(R@qs0PR'3+cPVX 9T\[33sW`Q   sWQ/ՠsW   sW'DGS-1210-10PSwitch3.10.013sWB1QP0R1D9000026DGS-1210-10PPort 8   sW@| 9[\\7W4 a]IXbw͙C_G4Dãfxȅ&1Q5CmmQ]ryf3x(C^q2wd ՐMT {cX?Nhp.C6כ'LAi&_@4ː)wqp{aKfZX]PP :y0]~-!&4 ://f)8%?xY9_"/q%dէ88k&I;G !/7}k`%5 (5/?.轍g YG Jk)U6k5Aғ CUdWÐ 4qLzl+XpX-PK{BjAL[ZJ=\lͶղyO1_9{}tłNv%ҷ2R}2oq[JE4$~z&꿟`!ű($'-D @Le0IcD - Q| L `3ωSa5Dž]^|AA1 5~z^Mr-vP ̜+i 8j#(>^h~o\ dIk{GKK!Aᬪ'736դep! &Qb @QU( @n[=2Լgw` 0cĂ{Ű&P+ ~=:gj.. ]B\𴩛u c[_U.;4R/Y(^MmfM)'1oѭ01@N!bR@HRD D0)hR`D* ?J!lal NnwQэwxV{#2{ϗ/ƸQ{/^AQAux3Zda,8n8,=' ]wY~Gf^gejsJ5+!i#:v0cY!01@N! b,K @`M>_=1r%]΂"}k4>ӆB/@K[}&])1!t{oD5C7)Qso@'Ca`kRt0KOzW_MV&?XX 9g[77L^ eBp1E)R@Zsj#nP=XRsP-XX 9g[77L^ eBp1E)R@Zsj#nP=XRsP-Xd 9[BBBp1L^ eE4;@6Gj#nsPs=XRz =XR=XRdX 9i<[66L^ eBp1E(R@ns0PR'3+cPVXX 9<[66L^ eBp1E(R@ns0PR'3+cPVX 9[^p*E \D ؼlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9[^2,E,L_Ll/M-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9I[66Bp1L^ eE(V@1v0sP+cR'3P+^L Is2 L|MF~}yw0݌!.ؘR2DTpLCnNaRa4BkBnɢ#dp2 eο}?t鐰|-MҘ"£ۮa+WW{矮IE^*~S.*jXwu=$-FҠ)(zd@ -K)\9rcp:58im ^5P!Bc "i.w߱>q H|/<Îs!.#AXb@\3,YXۂV ;H (@{O|k2Մw{xa^~W6q3Arz0eΟaRK+eq]c:C rSK2BaE|lN78>'7iesBg `P p!%! () Dr)E+1w$c)Q_udZ7n'!E(?2I ĀGml qC<V1%͞P5ͶSh.}ùN0T'Zy*p?uƮ.Ql3Ke1INS=V8:`U@b!SaaYPdD Ҷ Z ymjC}a@C tSHBwv,?slAY9;/4rM, DPFp-ƠSqflj=W|}vDR*2L`_T8*yr<( !eBIR X\ 9fL[<<#`GE(b@@QsKz4 $WP ~:\\ 99[[<<Bp1#E( @@=sKz$W4 PF&8\ 9[bb33\`,\"#, v*{\p 9`+[NN#`GE@U@@:sK}e%5# pd 9/[BBBp1#E4@@AsK};Ke&nid\ 9`/[<<#`GE(T@@OsK}e&;LP P/1.1 \, 91[  #`GE0@@sK}e&;LP <WhtSc D3ްP'ǫHb c IU*-&q#*J't~]vLo& VXNމiw_ܙHb_ɻv 'C)~`0ljwC> ju&sNp4 >Keyҙ-$JN $ݺS}!qN۫/suÍ>` lOML@ 9gU[Bp1#E1@@ sK};e;PF"pJR|v~FGZ-XI k;5? RgsCٽhGd*6urV~]w(LdȜ"72DkfѰsMR"kES*9O"$x8ZiOw快3aLq V4<6POv,pk`OibPTٻLLYi8(=rs+(Ƹ?y#_$63=?\OY N{{ .;0A0(.0p`C #/>^r2*)QI6¡PS2[(w65,儙 !639fh+BOjݱ?1PժXbƶx"TQvy-g^n ^b޼[5uT'xjUܪǍG3Y{Zcq4ku21 Y5cZvQ%@!UE,.d`$ҋj4qi۲mO*zUS11sq>VV--0.%o ?Gj>\lbffwِ( Ӳ(2Emx~iz9FZm:C)"f7_!RueoVy8lڬJָ)%j ڙ~56 yHH 8մx ]JL06-i}ExU G8eT+'Giqpzpjx G_rF ʄ0Μ[uã,PO>0c ;o9+!X桇*5qZ0gґP&C>oƅ51%\IRW%ܗLObs@\ 9U[<<#`GE(@@msK}e;?PD@@\X 9V[66L^ eBp1E(R@ms0PR'3+cPVXX 9 W[66L^ eBp1E(R@ms0PR'3+cPVXX 9[66Bp1L^ eE(W@1v0sP+cR'3P+[ x/"GU8˺/(@`̵/G'5/?O.O.AϤDDv/n(0<,n%yW8ӣbtJ8FJ Ss|NqX:LEV "!胀3|2gmL>5PLz}=-1OΟQ)=X̷݄ C b9Њس}S@ԲiF}6rchA ǁ)L J(_q ql,.e}?ʄ4g㔙Xo5ɤh*}S&+jTZe)1-+yo {)op@y :]\d{7hu,Q%_^:/(J Ϛj.%ǘ*[IvuCԌe2 ڮޯs X U*A1"h}0CY5.BfYqI-Et P:/:fXX 9[66L^ eBp1E(R@ls0PR'3+cPVXX 9[66L^ eBp1E(R@ls0PR'3+cPVXX 9s[66Bp1L^ eE(X@1v0sP+cR'3P+213-0S6P/ ^ԁd,VTQ/> ]*nY zp@! We"8.$D@H(QTJgϳYLk7q)uK52C ̏nR$Wʻp  -9nO2 ↓>q 3Y=纹q̻h-]~ok,T0r;"%VG֤&'V q;]#:CgJlE! aaX6#=La@2S8sQjiݓjHO+q-@)O* E֩u\Rm1M>9i :+$-K _z_H o'C!o_bTB0'fyB J`]TIZC c`P !A0)o*o t>;wiKns {"@b '6ڨRK໣,>׶n(\>]o ΢_ə8UH&1[O@g9V"]GͿK$0rw(x9(Wj۴7iEK91@@p! ¢$$S) mz~-v%EO3̉>Ecވinpch1eULAjQΞJ U{ntNz?t{sΔba;o{ÚfQ5I 54xB*y\!@b!ƂRDp jzzdcPQA돚9P kXA#`҉pQT$jy[t'aZV=wO^8NWVъٖ=5\48S|1^/UW-!5GgbZQL֓&wT1"&(XX 9}~[66L^ eBp1E(R@ks0PR'3+cPVXX 9~[66L^ eBp1E(R@ks0PR'3+cPVXX 9l[77L^ eBp1E)R@sIP3BZPxXX 9m[77L^ eBp1E)R@sIP3BZPxXd 9k[BBBp1L^ eE4@1XmIsPZ3B6 3B3BdX 9ϗ[66Bp1L^ eE(Y@1v0sP+cR'3P+?ts 8!$ aXH(p(g0.1yX1R)@_nw`ae@iJn6ל+O+?XQs8Yx4ar"Xv_=ӐycrN^:[̂ @\,q0`i֔>w†!б5A!lH7: A;Ilt~r y~EG-"igj_jDI5{/^nK(۟|91ݖlcl0>?#-yc2tIAC7!..v=Vᑕg qu]y1%z~:C#8$a@`!D XrrD@R8] I-~!~ `>Na CQRqQE.첈yw5PVZeh)/>ަE 0k8% }S&jpZ<2xN54@Xq2 H n--.Vm!Q|^-l?! Mjb@*@UEs b H$pWw@ G:cCcf9JxBy8ĽҲOU$xog ƪ&Ik~p01P  O~e#q?J;}\׶g 0C!3bd)  /,PkƼ}T oG~p0O`XX 9Z[66Bp1L^ eE(Z@1v0sP+cR'3P+3.Tb$9,V"3/֖&o<Jvype}Hmi fff,a߿fԱv>~\Z7x)kFRm@ 8R5/HꦪqgAV%瀪P@U hNUK4K61uMHh4!<шHt+v μrw]  2y5|9Mg؍Ro MF5:Aie}X]_T㟷E!뀰eΥNjtc򫼉Bt;!4S[`sioDw=sԁe$*I?VtwfF=g(iIoHrG:;#[cPSe2|A𒡍_l VOfܼ}SJSul}þ#5I'OAt_rdʀ1$E  NlvS [CZ١9M^3[l2=pf:%B 4$:8 %gQ{ %%zK@F2]ĪlAC~| :%毓85%)Z`aulil%鸶7KRY"!+‚lHG̔9:tp͂&q_#@3~a j ~RY?j/M3,񜂊Qm*LGW/Mf޸b+fXK=w+^&=_e;3Lظz::uAKĭ~ZtSi` D8!+AD+ !8&oZ @U 7{#PE8ӥ4PÍFi?"^F^wj!}ւ׾P4q۵Db3t# //sǭ0B&9=#ak_h`LJρqAàA6xqf!D@.!2b P j)V/2=0!C/!XX 9\66L^ eBp1E(R@bs0PR'3+cPVXX 9\66L^ eBp1E(R@bs0PR'3+cPVXX 9 \66Bp1L^ eE(\@1v0sP+cR'3P+Xn:#\DhLY}&Np5㆟L&aG ];b@S?v|0M5u}& @\ Hn88B++N{vRe"!:ⲹ,K H@2" DX~^d #QRÓ:Ù%[L5\?E/m f"@ yX1̏@1 %0pHp`8lnz!h_-?^efg>џ&$pWF8} %Vuho ~Vr@oBܺWjwyj{YeN y / oBD @|>qH@%\so0!+q!oaTPp׵ڲӨ-`h?dԑ H#0F;j"ZeVBBrwSS)"9肈 (O WI~?wf"=58֌DmƬRXX 9+\66L^ eBp1E(R@as0PR'3+cPVXX 9h\66L^ eBp1E(R@as0PR'3+cPVX| 9\\\ )ENgQBh:2 FDEDCOEBFCFCEBEOEDEBFCCOEPFCEHAA |X 9h\66Bp1L^ eE(]@1v0sP+cR'3P+emeuy|n*r}^r.%)USXD ʮFmˆ!ݴn!2Є) &7-C:sP5P`/MN)",Q0)"'241^~\Յyzf sjv@fo`]0/#'#%G3̈˨ US+C +2njho _ï 5% N##Ʃĵ˦e@oAڤL)}J[W-k_\6^1ǑOj3R`l:Ump.-?.@w֖T7Ы-<<7o VvH}ѳm.bNk̂nTW)3-9.R[@Il$d0<ʒ#MVUιh; dkER@}{!I; s[2t7H1u?Igrs73%r^RzcurX؂sG̹(GJ? mZr9.eHnmT0 CPqdf?*a)]g]DN3y:f(+wh슞^RE-AdQR' D 8^aZƽ9<'%:%F@)bf\D*J/5/N'(6)=R-N!ƋxAD_prDk $&B үYiqbڤ K,CThh5~˖y`QK=\8M DXA t K`8,4\ʈ0/v*&Ư-d>~Ue? J  lPlM>H?]j`aH`r~"XJ0dcT~:&XX 9w\66L^ eBp1E(R@`s0PR'3+cPVXX 9Vw\66L^ eBp1E(R@`s0PR'3+cPVX 9\ggs'EY;@@3 EC-s' 'DGS-1210-10PSwitch3.10.013s'B1QP0R1D9000023DGS-1210-10P Port 8d 9\BBL^ e`GE4A@@l[DmP@a>i  dX 9>\66Bp1L^ eE(^@1v0sP+cR'3P+DbJdYwk~!]Lu[/Iq2uU!-y+hyeJFr&b h?O+|/W3u A^fuvW>5e~^i`Di/)]3Hhc"*$YZFRZ] Z| 8Y,)քWfC>2PtHD*Fsa~U (aɒ$j OX, Or =GǐaH#c|놫<w,A<"':$7]< !jIt{ +O$[:% Nq9S/r.1[/ur \/00 T܀'eIww>&]5/a@\d`1̊d'(A_L)3cX$. GRDKq腺<.Lc$L,K\9>>"MEqo^RDxbKL b VWThQHj}F:}ONlFԨ"Vؕ"Hɝ֩S oUs:Y cȇs% $pB=rҵ!:ⰰH73BcQ VՂEt>gK4g"o ޤEg,Uv(D DDxg'g]#'mXX 9C\66L^ eBp1E(R@_s0PR'3+cPVXX 9s\66L^ eBp1E(R@_s0PR'3+cPVX 9P\^oE'y|e!ؽlbM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9hQ\^p*E ؼlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 | 9Ah\\\ )ENgQAh:2 FDEDCOEBFCFCEBEOEDEBFCCOEPFCEHAA | 9l\^EZ*%lM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9q\66Bp1L^ eE(_@1v0sP+cR'3P+V=pCX8,u5aA4NWc^8+qH@%_s8!2ⲱ]5,vېNM-M/4DFnMVקBxjW[E@ߘs\7HuRUF-~ U=E7A"ȇCŇ?~'o^F㦓"r(w w%.!;jb9Pr2gD{4-І brzӈdG5HJ}_޺VkI|r"(c,YR𕄘nصzP?Sg&7ڀqgWq蠰"nc47i(/p!bAlH9XH(*UXw AL= /(Œu4,DV%=Zt0_%M"󊈜Ym&3:w[.j7zVc:;7 0,kE"|hoӑ$W#ztp#XX 9 w\66Bp1L^ eE(`@1v0sP+cR'3P+0!bAȬHG:¤15BTg@TED_Iᐊ; b U"~/8 ?|2Ó\uI78 3T}-ꕸ:uf.rFQ;c):4+j sʀ/7$%N ZilF`!B"lHGisXݎTk`?TD}ْRF]6:(Fw 7Qc*5/yB1?~vԉ{ WAƭ`ˑWU5`-xk4z8\e!uV9ѝC@|xVH/2Oy b!bn\]B@tZllR(e'-N&\;w:j/O1ȼ4\l8?OϤ\\o:}2 u|>[j$Nop0xho ʥ}JO!J aqYXE#āU$j٩%!Q)E?< Ru8 8j|'@8Lř^ Ԍ>^P5)kM|z7.[ gS^[@|'$%#m[t)[2Zsal홛b aA~ڡWW=``S Y@gCË́>(@"Թ!@ts~ҷhe,p1K)XNXX 9w\66L^ eBp1E(R@^s0PR'3+cPVXX 9w\66L^ eBp1E(R@^s0PR'3+cPVXX 9A$\66Bp1L^ eE(a@1v0sP+cR'3P+);P#$:% }hX 8/݄v8.5%'D\m*Dr;+]޻7#zY;ADK0y|=E-$'f'\jUSbS q z&i*Q%o{a+2$= A0A_myAŌSܱlٓKS gTuVZ5Sޭ`q $yN焁o JΒwܒv0 aɺxzjWVa鏁 N+Ӟfk%t8ؾY _`HPWk7*g M/2}W+#,|"/%Y8 K뽤IcSR*C\V)SXKC(-$j` WOw=/Z;I6HjRrrc}Σ:R[$1dXO־*&KƏ>"?[e`>CJș\$)EYЭc]#@$C+ :oB[ùaBA"T&W%"QkXzjFN*{ڠx$t'G%![ק):/0#H `Aye\4hX/]yF%tJQqK4킪jA/5%"v!@[wx\#;L3ijU{Vѹ"">AĤDO+.0d+{C iySc# |l440}_~ >u) ٲ5T d2N%7f྘5B{QeGX?<z;̙](~rMrX| 9'\ZZL^ e`GELȱ@}{{8{#& }J~=>9JChJ$~J?w,|X 9M'\66L^ eBp1E(R@]s0PR'3+cPVXX 9FM'\66L^ eBp1E(R@]s0PR'3+cPVXx 9Q'\XX33H$c ކ`"Eh@F<"XDkevin-PCxx 9](\XX33H$c ކ`"Eh@F<"XDkevin-PCxd 9(\DD^H$c E6~G))"ADkevin-PCdX 9R*\66Bp1L^ eE(b@1v0sP+cR'3P+`Œ@P%ߛek&%!dB)hMVΕbmLewغvO̻2PO{3Z>^Rr\ފڍYQUqHcgHFP+MkY-~cȮa&sj;p/QKK2jjOvQJ'F@<\ĽX{ރF;VPÙf8N8Wnm6.)m7z?1S#Err6gF J0xJ9*[GN[^c1*Vbеcy&m v#jec5A㢊(ZF7LR1"miQf"x)Rv+:%)܊Dx`ڞw!C"lH)2"r7*(uxXtp9F.OV5O\J#-PzPmFgdTfCVZǠޒ{JH]PŐe\MfQy=[vQI+S1cBBn=@|xfI?5`2ΰ˱!C,)`H@ A&Vr^6M@촦дO ҡ" ab;}z(/g*&*KoBI;}N8@.IIKKz\Ռ%\m(Y]8%RONۚW~]k]"D!DaqYraD@)\LD \ OzM#,<l2ȟk$$KJNE,_+Y2v#_8s̱eTHqDv:uSpW PB\uk慌{@ mӑPAe~XX 9_-\66L^ eBp1E(R@\s0PR'3+dPVXX 9_-\66L^ eBp1E(R@\s0PR'3+dPVXX 9!.\66Bp1L^ eE(c@1v0sP+dR'3P+>l7?y^У"Dp!K.A$I {Jށeu b>,? CP1`ɝN~1Ҵ|]LSBsJCɏfF90ªcwb@?W$ ﭔ%XNėG ٨`]hpxڂXa%&;5G{@|x>_{mF@!;p&K Ǵ@R]o +`Noe3[tB%/ ь1&gPZBѽ@-jMx: 9w]+1mPa ]2<J|QNtgU ր-&Jѕ5kRV6@"!K Mja: 2U,j  \à0D)>9yGD(ȩU2]z`~ *_w*є!bamFmj~x9e9M<=n;u|U+;t3ncP8!k cYUh urY(%6>:,|J*xҍ\SBH4Afwe2+?2bM?23U!d砖dN`0èx/+1 |>=L],%nRMuo?7).MJ0}0@ p!= SaAYXXi0 買p1#(<GRnDqck\P* a Ӫd1\Ds?Te\V LLVRQwoa'5\ çU[4uѬiFV1Ag)8D/{]>q'Lwr|{́0 @!b¢lHE:BH) *" >sDa^&O`]YBX 9 /\^E l1luM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 X 91\66L^ eBp1E(R@[s0PR'3+dPVXX 91\66L^ eBp1E(R@[s0PR'3+dPVXX 9p{3\66Bp1L^ eE(d@1v0sP+dR'3P+P)yIIҒwձT)Maf]_n7BZ̗<{ưZV:a<׊ >=R6[@|xvH oV 0!BŒ*bu2RCwA~@!3,h1@ -wsY (FR8n5?W€5h$F B R!,>ד-J b,kZ(5Sv뻢UEpԮQB38Bж[;t;  !< QaAYXN h1TE@ W4I ++t` i1II7|y jJ&0"E֞w_ 0D.%,y0ᕑ~|ށ!q莜E>^i*炔B.zܚ7x߿Ӳ_7((``D8.5/|rWHӪ{d}ą@0Ax,0 2z&]Sr6gsvAe SzHj]jP`"W?P#8.ki!T(ҏ!݈TDrdAzRYkXvR[P¼[*(9g| DxsgXQwNgt* ÖA )o1霺Y$7LHvF YhB)o+G3=vIY^EŰS.&Eo$;yiҝk Q;MHZk]S-B5rGM8bXX 9~6\66L^ eBp1E(R@Zs0PR'3+d PVXX 96\66L^ eBp1E(R@Zs0PR'3+d PVXX 9,9\66Bp1L^ eE(e@1v0sP+d R'3P+zLe<`6Yyc{8܍{ZPkf)(/hsX m Y$t֐AHU+%~M]Qh :Yp <fulap+B*VFn(RY{ä:;2… I4AFK Mr!:^X"Oͮ(RyL4T ͙QemB5([oo\/t 3jAeʲDe/YПn\}* ӎLy엊  t!d-Ew7:'AjB#ٲ4^\Lp UoK_\bǡMf#1}ZȞ']4f P:w*ux?~5M k=E%?aa_WZ;Qf~H>q8vb!_2~k.ڒa;I%)a P͟𙖾GKo`n,/Ah5_Σ3(Y~3&JTJL/6:/ZuU|qmoZZ)h_'ϿviADJLT|;(3/.z 'iR44X`hQ)׿"X]`:/4DB<ү] 5 5/P 3/ @ $ (!3‚L9: )JTB *A0 OSqKI!Y}RઃGm0\̘T>og< 5^D^=oZz7v-]WNb( YێhbDuYwvXX 9(9\66Bp1L^ eE(f@1v0sP+dR'3P+#|c8!:_(tb @!: lFx @+-רH`1![h" aL(+l*L|%ɟ|GM ܣPѲ"FaMK 蜈AX 3χ&.Qxp %H5-&H]V_JZ쒐"!JЄ` h1 +5`k"w{;3I5~~VIb}0FQuㅖ^p}/\ǗXL̆%LJpFv)S]^qM)φVZa !+B lL"L 3+ ӫHtc(곍@V`'ϻu#қ/܇7jsp#<1UYw>ULĹ^5E 00Ǥ4! gnR] }EP")ϫ(죫Ye _IΆΖߋ'}sa!B&$* " ޫTpc(Wf`?aPU-԰AB}Lsv ` eXX 99\66L^ eBp1E(R@Ys0PR'3+dP~VXX 99\66L^ eBp1E(R@Ys0PR'3+dP~VXX 9EB\66Bp1L^ eE(g@1v0sP+dR'3P+JGbH eq> A ?3(4fuƁ#FK6R`e5mD\Jq1N_52*hO&qCU$kƘ癆q8yV/uv@$Μ_Gg'rMƣL^Um`/= B&si`!2‚5D RC˪l&or@(<~ /8uZ+%$`2"\C$sxрsݽ-O*B}֢5/:+zNޯ΃4CPn'}\$˲¤IB47inI":.w'ZD]@ 0p!3A$$' DRk,Uz!C~2bl& x8ԱWiEr5;`*5&>=8"|Lʫ(qwp,4=-_ϸ=Ej?e}7C8~?aɀ `L8|gn ϫA4v)N(hoL~Y&#못0!#q L R;OXM8+@ +#1sٳTW'VӆݳT*o<rj{$i<4.j"SHJH^{WW\]GQ3 krםXi1ֆ]!ӿ)00 /.m3>Oe[>1A C9G@EB8/`x-8{EDGh:1`dZĨpE3fcx kGGUJK73Xd 9 C\BBL^ e`GE4@@<wTО͆A+ ,Pn1d\ 9KD\<<Bp1L^ eE( @3wTОA+ ,͒P!\d 9GD\BBBp1L^ eE4 @3wTОA+ ,͒P!331d\ 9D\<<L^ e`GE(&@@2wTО͒A+ 8P\X 9E\66L^ eBp1E(R@Xs0PR'3+dP~VXX 9E\66L^ eBp1E(R@Xs0PR'3+dP~VX 9z H\^oE'z|e!ؽlbM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3  9$H\^p*E ؼlM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9hH\66Bp1L^ eE(h@1v0sP+dR'3P+ uxq-@W%~U ʺ/vv-ʁ:/$vQ9L'5/&Qxl%%  tm$WAhO1-@A%!-Ɓ"@ F8ZeLY9N`HAWZupUa*-L=%z ?Ҭid.Xb:F.lT*2h7sv}J{7B}P0 3Qw)~V6:TmB32^}>G3 XưI/RFً"s4Bnj b5 wDg&qJOO:em py,ːM NpMBC.." p$NrZث<ɇ]95IMx!yyy}܀5R}N[J. ܌@A-dQRߓGY"xrJ?nvA{yzD) XN +; :/⴪˴C@ElT#o])@B= v4ց! /G kgQEV נw˧D)#/wH7Nyڇ jG&Hͦ47#d|0A% ǁC  X 9J\kkBp1#E]2@@sK}?e;PF0\H*+lŒga_w*.#9qR4\ 9J\<<#`GE(@@BsK}e;@ P9\\ 9J\<<Bp1#E(3@@sK}@ e;PF\\ 9J\<<#`GE(@@=`sK}e;@ P8RO_X1\X 9RK\66L^ eBp1E(R@Ws0PR'3+dPvVXX 9K\66L^ eBp1E(R@Ws0PR'3+dPvVXX 9'mM\66Bp1L^ eE(i@1v0sP+dR'3P+~]6b_`%';fԬm#`zVmr A#vK:^ ކi /ݞb{J> 6U$$1a*0|ГKݮ31Rߐ%*k %=:6 dIO X/CҐS27;BlL1&(d4'QpOSP3)p_!ĩ`sٙ+GP=!2A .6D b$Yl J5 7ytUJ'邆$Wr'S XN=8rqN%,؈rc %lcV& !TD88@]bEΞίzgֳdgӯ ^fm&鯯2DaCCG+I9@bb4d8!A¢J`VGo6+8 KLu;~ƚIS @T (ShaUPLٹyV.LP/VdE=1c9߇uBf'#|?Ҳd8rܴ7}&boE޾)8qBap!J.ÕkmB408npERgjmaL0 bZt\G/benX]=q3O=md؄`! gؐ h)tժP~;73Qߓ+>,C "ucHoĈ~[ W~\"1$Hbi5:Lٌc{3@^%grUd4K.=b7y?Vho ~u[XX 9{P\66L^ eBp1E(R@Vs0PR'3+dPvVXX 9JP\66L^ eBp1E(R@Vs0PR'3+dPvVXX 9R\66Bp1L^ eE(j@1v0sP+dR'3P+[!"D!5aAYPt @܀t *ҁrx|(>`M1)"N(p!.%ʒ5|ޅ9-k8ƅr3u LK Nbl1}!? @!; SbXC$ \*H==-`d 2he"c/W)EJHn6n^Nԃ+ [6e&񁒙g`1ڥ9g*T.o3 ݩ2%"q%뭴7nI&:2.SVUnH @p!*&±lY1€9h]*졎4dz=Apz}6۝Ւ"V9,o&RK[g/'oI%LZLc+\ 4pp4B߳ o_~@Y4]KumMzic}#U`@ !K²) F8< jItA6&[7AG$+PXREWw/*Wq%\+&Lz}U&5Lx-y+o!~ q Ht-o*!2!CRPP$,aD4X1mLL S M`0`0FLfWZ*AIv3[a 4-e{ń0輆QR"X{&1op>՝iDET݀V rZkф ߄*]bwxQ߶9?@ 83A0_"l.NR$[&zQ#/X8ī%O/%&hya/|rʀP:/je lW,iN{nq:N ˖ԫO˙#g) !?f!."ɣ,iQRjzji. Ҥ z'eáD=LK8j6yfqCz>=K@XSޮ)h2hD/ !b|R:'8fX3I4U/]g9BؠbQl6#n<0-bv˩Mc}e &si׏s"\c/YP;3DڃJhX.YVe"zA1N{0[5ujgiZ^P^gNK#R6\繟Hy Ù) 0R4FI/B`ր_S8V5d yg1-LPNJ;H%.~:A7</&.7a'M[M#=}݂q}OɧrݩB,8($%'wcHdy3[aɆ4(a˔j~7DCOz{r(M 9Chj`H&.ʶ^y#I :sfMv\EX 9`Y\^H$c E~M3)láM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9*[\66L^ eBp1E(R@Ts0PR'3+d+PfVXX 9-[\66L^ eBp1E(R@Ts0PR'3+d+PfVXh 9}\\GG^oE9K27%[,k charming-PChX 9ba\66Bp1L^ eE(m@1v0sP+d+R'3P+\Px=VwXoG> ov`D+ rڤwW`*{ﳿD# - 8L*cK[D% PF+N4?Fʧq6+ՈlwbxnGayPH2M>`t :?Rpys 衽cmq?\' cH,a ñA :J, (_>ՀXU..1`ZW$~niĠvA0AJ0)5±\SwŮ֍',KUrECטͼP7MW6rJcd\- s7myzj(XE(H[N[DVzx 81Rz7cȔ&jsPK$[FZ$a~[Psn7C<ߋMRLŊ9eV̞ϤQ"L}d'G?j!2_7`ɑߗM9++ obk%s{A~5u9yDM%xv_ d{[^b<ʘb0Oة:Bl}^wXeS0 /5QX| 9=b\[[33o`%4af%WH charming-PC|h 9?b\GG^oE9K2f%H charming-PChX 9!qd\66L^ eBp1E(R@Ss0PR'3+d/PfVXX 9rd\66L^ eBp1E(R@Ss0PR'3+d/PfVXX 9gg\66Bp1L^ eE(n@1v0sP+d/R'3P+):C^ۮ~^+W%GSDAŰ䝊$g(X!, e XHY ¦V#w(eeA`XXupX4M`fPN$x3iI}]q[x]+#wAz>Ql!MLDk(!# l % \P $F]^($-"e LVșf =5RM>qH|)HZg` !RIPRTDy G-B kH]aK`y`W4T 6t?-ZڽJ~U ,s oadin4ՆMKk ݯ7\9?]ofZGWXi?Li*n"`gho !+&²$'J4ނKi;=~ʀP8oax "KoPP,U59 7zN⚻4 <Ɨ(ynS, 2?:c;2I~m?/&)l,u?'l0#U/Ow'V!WxJ3¹Ye8:PD!*BHT#ƣ7,\/WƬI` (%#e6@F@qh5ǃ/{hap@"Z7ev{1:.84\Q1b PKE]]ks̅ L TzmZB$~_A"!*ƂHP$DQ PߎO· = ]Qׯ~\b5#g 5boߙA@ƄJ]Kϱ7:%_uNjiQ,׆콣Gf$gur_?}cAz\T Tt֖ sa>qH|,v32P !BƂ`6 Q.כ@X| 9 h\[[33o`%4af%WH charming-PC|X 9xj\66L^ eBp1E(R@Rs0PR'3+d3P^VXX 9{j\66L^ eBp1E(R@Rs0PR'3+d3P^VXX 9k\66Bp1L^ eE(o@1v0sP+d3R'3P+jA'Q[-Oh@q5*)z-.DnMƿ6 X``}w#d-I0<&epNt/q. KLЀߑh!ĊX9]_I~)l^m20 @!j°JTD{…qQ_$'9E}g402Yˤ_Եj0D~.nv|meR4WU'u *xЩIG'MDAA1ȗ_/Ģ o;MH3|8W,U !*A79ZH. ;X,W3g#dg$ ȭf=҉'#K9Ԕ t'_}NgNZ{vy-nfE 9<Ӱ' NͣӾ* %de%NYHS]MB%y7!3ecTGl(g̑^_ѯSq7 6R,a,hj<,S`T(B3P"JDR߇ wZeigUhJ]\UO_|($DA8ݤ>0Aj "D!C McaYX& RUD**j$ z՝"orxwvan!W)3h9ςE (Ůr w5i 2JN{&TwVT݃3 \qgE"5{NR'e6C0Ԋ+~rAm'0) tϜU?6fON.ʑ |'5mU`vM6tUc'44Ղ_Ƃr+u+SZ-0`+-EHP71 )624lk(4ZӔGO8^hQ%sY#f,bi_AP YazF4RT#ݶ"\$->G5 (5?4VjA@gj猗[7Nm+S&K?ȐMڑr~^u wiךLz,:͛:$O!bhSbFʷvcGvN!a 'Xo.ȍQ_+~C;/$ܗ̇dʃ)k pn:v~u7I ec@`̂sR1$3Ax.Àc+}jpf3s5>98aN}0ۇ?Qa:#4!TvTQ)iX,88~in\0|uod?x RWp)Lju}F65òxQyi2y"7x:M sh}%;wr t* BZ{BxѯHoX(2Ϋ!TRʆ)0(xYSˆv>PJzJa5\JydBYMݕ=D@lA"B&Fme&bF=|M^Hd ` {dx 4TXZg uWZ$20"db(2X޷Eؠu+ v<0s!]~`Ա.јd$1*_/}쎞ag(BʮK8ų~y!+ XX 9U w\66Bp1L^ eE(r@1v0sP+d?R'3P+$HJá§'=:_BO!ÄN1퐸_l4]U4{DMҜdG#AhZ˜ j0`sgW 0;,X [`5xu ^I@g *Yp7z?R/Kucu6:hҲ&e̋yP,jeQrs@M5oz( cl _`G'UP@xʆyf[e\wCnxzS ubYև'ʽl`~"rч&ޮauTynRO#1Ϳ>Ëh<\]}oJp0o}ǂ>88s7p-M˘Lo>yX҅:Eә+fo).ձ'[@㞶"mQ|A6cәs4׼ޓHNej #ݶK-mq$IJ+/89RHTC';*uݸa㎚"&v`OĐ奀k,]$\,K f>#Wkx|ђxnXGrgޣE̲fk>19ʼn7i n1ǔ"8A.L&< @g(Rh͡I]y3mn h e2ְeMPӶWr&ј)rWLU1u/?;tq. 8ֵ KqmưefՅ־Cp|b-l/E^feJn9sA3kz``ivNC;Fd_Y\H$y6 4Vb^[q٠q$A|>/HOBUC$v~jdkf[IYpm/ODVt>'4$x|r-4KA'xe7rq<vT_HEVu=hX Zo!=neڒW;!,yK4 lYdf#f;@Gg*sⓩ"}ę$C/b|N2jI!Z"mV|[B];Ds֋2Ь=hg'i4X z{C5[jAQn5lG+nBo^o޾o9O쵥7>Ll`8U]8K'e;09C9$Cpk}a?Gk1hVhy|%4M] z|~'_qo!'lP.UK2 fuX;EaɊBOYLdߍF<rF7m7FF$Rp'Rbϩ+[Ǜ(B${+M]^!>Ƶyiu3"?X?ܥwhfci!8:7VLKսsi" {f%|p3O.w"7B" >1A%!Rd9(CEH 4\GXX 9ւ\66L^ eBp1E(R@Ns0PR'3+dGPNVXX 9*ׂ\66L^ eBp1E(R@Ns0PR'3+dGPNVXX 9Fs\77L^ eBp1E)R@sBW+A4aPXX 9s\77L^ eBp1E)R@sBW+A4aPX 9\^oEAV2lRM-SEARCH * HTTP/1.1 Host: 239.255.255.250:1900 ST: urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man: "ssdp:discover" MX: 3 d 9̝\BBBp1L^ eE4=_BWs4a+A훺 +A+AdX 9܅\66Bp1L^ eE(t@1v0sP+dGR'3P+[շ~NܐL9<%B.y|h|&T{m֬h Y#r'>R-r%U*A(%_/y.U,6ZF܂$L{7Vj&Co׈{[%in䎲/G!s@穔?wzs^ p+lF}X\*( S0߇"6}Z &-[Sv^#I֋t9\iMJDBBfy4H4r3R&e@64X"|`@ |Qe6L],{IMYhj)/kFI5,/% }W{!ϹN$嶢֧\i|cWn 1a{j|(G)_wl}ϧ+o}|"ჼRآ]`zdݝO}5 젵Y&=6hd /V(nX55'߯Kz|5LBlWZ?*񿖨f: Qu {[KO<%jreX6_@9<l0%YFOtӊC͙.>IZ|d|RUg7PԚ  5WmJMNyK~qN9.E:.mnW@ +?FpCq߳az2IRG`4ތMWP"Ʒlkv):Xl*ź5;|Nm{ףWҮpeq'Mm5_LQRs2XmR(@M j*u&Kvd'Z\~!*]aTVDUm,r7mMIzOB [~y LE@?!VoȧZh ԝrw{.^#kĂ "{)QaWqrbb lf];]D^ChX Y ,k!zl-kX 9 \^H$c E~P0)láM-SEARCH * HTTP/1.1 Host:239.255.255.250:1900 ST:urn:schemas-upnp-org:device:InternetGatewayDevice:1 Man:"ssdp:discover" MX:3 X 9}\66L^ eBp1E(R@Ls0PR'3+dKPFVXX 9\66L^ eBp1E(R@Ls0PR'3+dKPFVXX 9q\66Bp1L^ eE(u@1v0sP+dKR'3P+~ 9i aHNb9g-sc%dV&gRDIza_ˆO5Z=?zfAE{;~\5;kͨp#C"ל5=q$Q7-C֘ B.ܮ =kSҽ3%6DoY$Q:: r滰JWƘAѲי%ltokaCM"$ eAV͗AZ/Or2WPtns|,K0FԆ<t YO,帬{|!gaQ+ XLYVO&`9J޷ILơ%A d~اUKS$cZ˓]SٕGzU)t_=7]g}q*sL`;Dh.^|0cy2/kdK̅Vtm+  ?M[ jMCU"=9:`ura/Tw\뽚߳3Fcs11M)G4d2?-#nnfe3a&6f5Tk=kOƯ1: ~NJLj{O?qD҅e-aKAvD@W5r QPm1ƶ91$V}~)I(Y1T?U4uo=JNp,v] w>:nh{?/;pA:_>^RB EFGu&,UێC/L'jMzyr`;X٪H䐺>L!GKȉYgsOl-3,u}~N;Jkk쇢Ax)~bpen@h"ƈdY%WhƀC`EB 9lY؉` VԆΫ`YFhMHn dpjPa@c[nN>Iت1h8S7WXt 9 \RRA:ED@@wG0icRVSoU9AABXZWJDYWxsAHVtRG9sb3JTaXRBbWUAtX 9\66L^ eBp1E(R@Ks0PR'3+dOPFVXX 9\66L^ eBp1E(R@Ks0PR'3+dOPFVXX 9 \66Bp1L^ eE(v@1v0sP+dOR'3P+~oPq1aRb2.*6p! 4y9I~yg2]gOrz{hB9i7I[iH7vvV ůY\_,e\Ց15kdm3$JO"n{x~HJ|s>wed"r->Yƌ"# Z7?Ģ=)61fi w\p~HFmD#MFon+|b =73f _5pff+zARr :ŻcTH9(IVp~LR䚤!Gz][adskQltwfK(&@ga*<@ƸiJv͕k |B?&:-=P]8b{>/Yy-X i]V}riY/QX捱TB1JnF|G gh jj7w" }L+srGQe΍nRJ6~)@zuƙm9pNJ{KIcA[L)?`@kKEpe!089047t֣Xl 9\Counters provided by dumpcap 9FX 9\llnDPI-2.2/tests/pcap/6in4tunnel.pcap000066400000000000000000001225551321103654100171150ustar00rootroot00000000000000ò]NV";$΁4E|@)7Ii`@:? p?>sM& $]Z]NV !"#$%&'()*+,-./01234567]NV\y$΁4";E|V@) biI`@:7& $ p?>sM߽]Z]NV !"#$%&'()*+,-./01234567^NVB";$΁4E@)Ii`~:@ p?& $Ҁ`N6& $ p?%2,KR}}pI 1=u)e+U^:ZS;eڴCear^NV";$΁4E|@)ˮIi`@:? p?>sM& $][^NVi !"#$%&'()*+,-./01234567^NV%{$΁4";E|W@) aiI`@:7& $ p?>sM][^NVi !"#$%&'()*+,-./01234567_NV";$΁4E|4@)Ii`@:? p?>sM& $U]\_NV1 !"#$%&'()*+,-./01234567_NV$΁4";E|X@) `iI`@:7& $ p?>sMT]\_NV1 !"#$%&'()*+,-./01234567`NVI";$΁4E|@)Ii`@:? p?>sM& $]]`NV !"#$%&'()*+,-./01234567`NV$΁4";E|Y@) _iI`@:7& $ p?>sM]]`NV !"#$%&'()*+,-./01234567aNVe";$΁4E|C@)uIi`@:? p?>sM& $]^aNV !"#$%&'()*+,-./01234567aNV$΁4";E|Z@) ^iI`@:7& $ p?>sM]^aNV !"#$%&'()*+,-./01234567bNV";$΁4E|@)Ii`@:? p?>sM& $m]_bNV !"#$%&'()*+,-./01234567bNVҚ$΁4";E|[@) ]iI`@:7& $ p?>sMl]_bNV !"#$%&'()*+,-./01234567cNV";$΁4E|@)Ii`@:? p?>sM& $]`cNV !"#$%&'()*+,-./01234567cNV$΁4";E|\@) \iI`@:7& $ p?>sM]`cNV !"#$%&'()*+,-./01234567dNVG";$΁4E|Y@)_Ii`@:? p?>sM& $]adNV !"#$%&'()*+,-./01234567dNVѦ$΁4";E|]@) [iI`@:7& $ p?>sM]adNV !"#$%&'()*+,-./01234567dNV ";$΁4Ew@)(Ii`;@ p?*( ΰ 5;estarc10rfacebookcom)dNV ";$΁4Ew@)'Ii`;@ p?*( ΰ 5;xstarc10rfacebookcom)dNV $΁4";E^@) ӸiI`8*( ΰ p?5^starc10rfacebookcom <*(oΰ ansbRP*( ΰ PE c*( ΰ cE dNV $΁4";E_@) ޸iI`8*( ΰ p?5starc10rfacebookcom <xansbFD*( ΰ DE W*( ΰ WE dNVrr";$΁4Ed@)8Ii`(? p?>sM*(oΰ 'uXp' 'yeNVJrr$΁4";Ed`@) piIh(3*(oΰ  p?>sM˳ 'uX6 )8'yeNVLjj";$΁4E\@)?Ii` ? p?>sM*(oΰ 'uX˳ ƀ 'y )8eNVO66";$΁4E(@)rIi`? p?>sM*(oΰ 'uX˳ ƀẍ 'y )8i@l?|,WҸٕcNE5fՉp]"{+/ 39/5 www.facebook.com  #3tspdy/3.1h2-14h2http/1.1uP eNVEjj$΁4";E\a@) wiIh 3*(oΰ  p?>sM˳ 'uYy;s )8~'y eNVB$΁4";Ed@)iIh3*(oΰ  p?>sM˳ 'uYy; )8~'y tpT d:tX qCJwLޠ4+H #3t/h2-14spdy/3.1-fb-0.5spdy/3.1spdy/3http/1.1 d ` ]00ߠaqX>` F 0  *H 0f1 0 UUS10U  DigiCert Inc10U www.digicert.com1%0#UDigiCert High Assurance CA-30 140828000000Z 151231120000Z0a1 0 UUS1 0 UCA10U Menlo Park10U Facebook, Inc.10U *.facebook.com0Y0*H=*H=B5YTۿNXG"ҞI*%FBP_%1\Nd Fҡpo0k0U#0Ps) yH0UC @K03nqϊ0U0*.facebook.com facebook.com*.xz.fbcdn.net messenger.comfb.com*.m.facebook.com *.fbsbx.com*.xy.fbcdn.net*.messenger.com*.fb.com *.fbcdn.net*.xx.fbcdn.net*.facebook.net0U0U%0++0aUZ0X0*(&$http://crl3.digicert.com/ca3-g29.crl0*(&$http://crl4.digicert.com/ca3-g29.crl0BU ;0907 `Hl0*0(+https://www.digicert.com/CPS0{+o0m0$+0http://ocsp.digicert.com0E+09http://cacerts.digicert.com/DigiCertHighAssuranceCA-3.crt0 U00  *H 2*G9zb~A ;3gѩ]0?Doushe3*E ZZkջ'x^sQ^[X 'E;kiI[(ͬcaeNVww$΁4";Eie@)fiIh-3*(oΰ  p?>sM˳<'uYy;be )8~'y &FlUna\0X0@ _M[?;0  *H 0l1 0 UUS10U  DigiCert Inc10U www.digicert.com1+0)U"DigiCert High Assurance EV Root CA0 080402120000Z 220403000000Z0f1 0 UUS10U  DigiCert Inc10U www.digicert.com1%0#UDigiCert High Assurance CA-30"0  *H 0 a )^47Q"a pLPc&uA`B)6(e1tm6/(Ff*y&zՎmO^=Y{^6lS2>dXi BQD$zz1i]l~ RDJ:#䛶[Kε*7¸\#5^|>~òe{],<:http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@><:http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0U#0>iGԘ&cd+0UPs) yH0  *H HlS8*C횼>u."Ya͇ uT(F`ܾQ,|1p7[ Xj$HGF1_N4ǐ1МߊV:t]qBt_ލC|Uizaa3M9%5+$&(yw/W|Z0W~G1¿0|]$_jtkF!)Ԏ^BJ2okQX?m!jN ]Zva AIuJ_5}Qnk(D#O[q=ݟ ×w [۹WzD6<8nzF0D Xs5hB.ϏB[QEߢ1 >ҷ&^JHՌlm1{H^ĵeNVjj";$΁4E\@)<Ii` ? p?>sM*(oΰ 'uYy˳<|' 'y#)8~eNV=jj";$΁4E\@);Ii` ? p?>sM*(oΰ 'uYy˳It 'y#)8~eNV  ";$΁4E@)Ii`? p?>sM*(oΰ 'uYy˳I 'y%)8~FBAkyD6^z(OsM*(oΰ 'uZ˳I 'y%)8~0uce:%5La:E,jx؏d&eNV-";$΁4E@)Ii`R? p?>sM*(oΰ 'uZP˳Iܟ 'y%)8~-vM&}f %VԶ1ة?,XeNV{";$΁4E@) Ii`J? p?>sM*(oΰ 'uZ˳Iy 'y%)8~%7f95X%²`4h0r/eNVF..";$΁4E @)qIi`? p?>sM*(oΰ 'uZ˳I$ 'y%)8~Pa-o@HW{FFm;'UIʜύ KE_p)Zm.^+Ww?jx$Ý@S"Ҍ{/1幆Y< Ti5R(c)9;)V|k G.+l)`߰X]K 2Tl6VH_*U,mu zc\[}Mn6wC*#X1NhzoH |{bDDF|Xohp8YV1ge.oT +l_E3-c幌~Bͮ\䫥t_<lkia~u |kLw9dM!T|TkkimK܅ ef6t G^uvHXX??e)tWћ"ZW!p Ly9_sM*(oΰ 'u]p˳ILq 'y%)8~ :j (mvMЕ3if)Y%Zm6jE&1sBOQYztu㗩 B 9PtfkۢuX t 1|3R蹚OI S$VtMeF4p=H~ۮKkMn]'3Hmɤ&ۂǺA9_܎P ͒c1ZnM1(.n! z+1f& `v7BژA\R6)Z?B,^FlMweNVM";$΁4E@)Ii`? p?>sM*(oΰ 'ub˳I 'y%)8~m7jD濻?"¦'-0cS՘v\:j̙maOjx5VXd;T(.JY=ׁ@hhDwכ}H7Û|bJSl7~Eo 5,uD[XʉjS=SS[ x;x΅{= *>Z+=fB%NjռD 9HˌOX X{iW[ V]/CШzmx_@zR@djA SPev򵾙aqk 0* ^\Wh] r۽U<_IT¿5&1$L1*/ Lj1Ƹ<&MF+r Wp8bĞ^ƺ5Z@8eےFY^]Է5y@8݊x;VըI~O9[Xt:0{FYN9ݘAxO. k`k,pwɀlӸzU凉dr3V9Kզ3̭Sv"u-l^%"FK^PwY6$Yͣ{I4bΩRT/i[i{t[1cS,a.K QK*nXR0a|!-gh [torrdomn¡SBi}8PT(ei]vqq17o>ϾPkAL 4o%55Y,Ҝ{svxv_UUGKfM_#G6!u.dP$&+l'lwZ/LiO"ۺȇ#ctG 75E=;aYigȦ`B0LN\ӛH577"'ϐ$ ;eNVvvjj$΁4";E\e@) siIh 3*(oΰ  p?>sM˳I'u]pEqf )8'y%eNVGzll$΁4";E^f@) piIh"3*(oΰ  p?>sM˳I'u]pEb )8'y%O 0_R0g̛YcMu8u˔b_<wf _= Ӑ;U~/gcA~nS 4 LOtun R(w5Tp5Q]98zoR,{^,}"V3~ Q b2$7f%/J@@{(6Bk~2WalxieNVmz$΁4";Eg@) 'iIhj3*(oΰ  p?>sM˳K'u]pE )8'y%E6棎^K<1|1v14͍!M'D^lsD_]N$?0(HQeNVz$΁4";Eh@) FiIhJ3*(oΰ  p?>sM˳'u]pE )8'y%%6'])W;Xx0`,/mcBqeNV{jj";$΁4E\@)#Ii` ? p?>sM*(oΰ 'uf˳*f  'y>)8eNV}";$΁4E@)Ii`F? p?>sM*(oΰ 'uf˳*sY 'y>)8!|@# Gv]g:|% veNV7vv$΁4";Ehi@) ciIh,3*(oΰ  p?>sM˳'u]pE!n )9'y% 'ub'ufeNVz""$΁4";Ej@)iI`:2*(oΰ  p?>sM/d/ p?>sM*(oΰ 'u]p˳ILq 'y%)8~ :j (mvMЕ3if)Y%Zm6jE&1sBOQYztu㗩 B 9PtfkۢuX t 1|3R蹚OI S$VtMeF4p=H~ۮKksM*(oΰ 'u]p˳*b 'yD)9 :j (mvMЕ3if)Y%Zm6jE&1sBOQYztu㗩 B 9PtfkۢuX t 1|3R蹚OI S$VtMeF4p=H~ۮKkMn]'3Hmɤ&ۂǺA9_܎P ͒c1ZnM1(.n! z+1f& `v7BژA\R6)Z?B,^FeNVwtt";$΁4Ef@)Ii`*? p?>sM*(oΰ 'ub˳*H 'yD)9lMweNV0vv$΁4";Ehk@) aiIh,3*(oΰ  p?>sM˳'u]pE  )9V'y% 'ub'ufeNV^vv$΁4";Ehl@) `iIh,3*(oΰ  p?>sM˳'ubܰPL )9i'yD 'ub'ufeNVbjj$΁4";E\m@) kiIh 3*(oΰ  p?>sM˳'ufPf )9i'yDeNVcF$΁4";En@) "iIhh3*(oΰ  p?>sM˳'ufP8 )9'yDC6xɖz(Bs eU ZvH8ʖUV0gbGf%Ȼ|SDm\/<^z\WW'u{ܑB='AR2- g\I9ނ~nkXP>V6#R&!&q> (Ñ]8no,]2 uBzDwgo:y?5„Ib Ql{^r,cm&-2KGwEOݬeQ(*r} SYڂ9o?qD~-w}f>^G.k1ĎݼD^Jpvt1P>W !FgoL4H̤5'CD[`NLbO%>T "̣.pFNUa5=V#5ޚQ-OЙ|YUMڟm\Z8\~ L:Ǯc  ?-GK8e?;˲z <sVA8_ʹsA`ZDƶJס[zcTo=IX0}bΖwxb=KS讍U|9ޮ-ԡ>7-n\'\ӗ֝m4e2UY_k]b7j)L~l&Gtk?؟X hnpʧA>_@!"$,K X-BAӿ[!Mk6y$ ;pҭ h >7@H05v؍}aQDyԍ)$GF|xbnKO3%o̕R&by`?0s(Fh+?o(U՗nnYz- T1ڂ":eV/Xn;Q[E'PglTPg*YƨsdJY\.=ZyXD&١t4! D7cc߂b$.{}ڲ)`79fV8ϝeNV!J$΁4";Eo@) ĸiIh3*(oΰ  p?>sM˳'ufP )9'yD6.&2 )b/y>^Хz_)k|vvY(tGDTO]%5wHAYd|B,9Ou!snuU4MO¹&z< 0}]0!Dvָc,ȎOĪ֞s~`v$R6)73:MG`)>K~P5 ZDhv<Lt9вtLh dLk@#BBj:aeNV@J$΁4";Ep@) 8iIhP3*(oΰ  p?>sM˳!'ufP- )9'yD+6Qt?=[#V^&mdCeNVpKjj";$΁4E\@)Ii` ? p?>sM*(oΰ 'uf˳!V] 'yl)9eNVjj";$΁4E\@)Ii` ? p?>sM*(oΰ 'uf˳!܀V] 'yv)9eNV ";$΁4E|@)خIi`@:? p?>sM& $҇]beNV  !"#$%&'()*+,-./01234567eNVw$΁4";E|q@) GiI`@:7& $ p?>sMч]beNV  !"#$%&'()*+,-./01234567fNVj";$΁4E|Y@)_Ii`@:? p?>sM& $w]cfNV !"#$%&'()*+,-./01234567fNVA$΁4";E|r@) FiI`@:7& $ p?>sMv]cfNV !"#$%&'()*+,-./01234567gNV";$΁4E| @)Ii`@:? p?>sM& $0y]dgNVN !"#$%&'()*+,-./01234567gNV$΁4";E|s@) EiI`@:7& $ p?>sM/y]dgNVN !"#$%&'()*+,-./01234567hNV8$΁4";Et@) 6iI`N7& $ p?mi rsao=mE5 1IvW)@n~-9 fD{}-揜hNV$΁4";Eu@) 5iI`N7& $ p?mi rsaoiA 1IvU)z=xm>{$={n) rΆ3L/$\hNVljj";$΁4E\L@)Ii` ? p?mi rsao& $= vo1IhNVjj";$΁4E\M@)Ii` ? p?mi rsao& $iπ, vo1IhNV ";$΁4E|X@)`Ii`@:? p?>sM& $Ar]ehNV< !"#$%&'()*+,-./01234567hNVi$΁4";E|v@) BiI`@:7& $ p?>sM@r]ehNV< !"#$%&'()*+,-./01234567iNV$";$΁4E|@)Ii`@:? p?>sM& $!m]fiNV[" !"#$%&'()*+,-./01234567iNV$΁4";E|w@) AiI`@:7& $ p?>sM m]fiNV[" !"#$%&'()*+,-./01234567jNVB)";$΁4E|)@)Ii`@:? p?>sM& $g]gjNV& !"#$%&'()*+,-./01234567jNVt$΁4";E|x@) @iI`@:7& $ p?>sMg]gjNV& !"#$%&'()*+,-./01234567kNV*";$΁4E|_@)YIi`@:? p?>sM& $e]hkNVt( !"#$%&'()*+,-./01234567kNVT$΁4";E|y@) ?iI`@:7& $ p?>sMe]hkNVt( !"#$%&'()*+,-./01234567lNV0";$΁4E|@)Ii`@:? p?>sM& $:^]ilNV?. !"#$%&'()*+,-./01234567lNV$΁4";E|z@) >iI`@:7& $ p?>sM9^]ilNV?. !"#$%&'()*+,-./01234567mNV4";$΁4E|1@)Ii`@:? p?>sM& $X]jmNV2 !"#$%&'()*+,-./01234567mNV$΁4";E|{@) =iI`@:7& $ p?>sMX]jmNV2 !"#$%&'()*+,-./01234567nNV8";$΁4E|W@)aIi`@:? p?>sM& $S]knNV6 !"#$%&'()*+,-./01234567nNVK$΁4";E||@) sMS]knNV6 !"#$%&'()*+,-./01234567oNVI=";$΁4E|@)Ii`@:? p?>sM& $N]loNV: !"#$%&'()*+,-./01234567oNV$΁4";E|}@) ;iI`@:7& $ p?>sMN]loNV: !"#$%&'()*+,-./01234567pNVrr";$΁4Ed%@)Ii`(? p?>sM& $BP^nÏ 'ypNVrr$΁4";Ed~@) RiI`(7& $ p?>sMPB=)_7 1Q'ypNVjj";$΁4E\:@)Ii` ? p?>sM& $BP_=*Lj 'y 1QpNVN";$΁4E;@)Ii`? p?>sM& $BP_=* 'y 1QGET / HTTP/1.1 User-Agent: Wget/1.16.3 (linux-gnu) Accept: */* Accept-Encoding: identity Host: mail.tomasu.net Connection: Keep-Alive pNVb?";$΁4E|M@)kIi`@:? p?>sM& $rK]mpNV= !"#$%&'()*+,-./01234567pNVOjj$΁4";E\@) YiI` 7& $ p?>sMPB=*sMPB=*< 1Q'y HTTP/1.1 301 Moved Permanently Date: Wed, 07 Oct 2015 16:55:13 GMT Server: Apache/2.4.10 (Debian) Location: https://mail.tomasu.net/ Content-Length: 313 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 301 Moved Permanently

Moved Permanently

The document has moved here.

Apache/2.4.10 (Debian) Server at mail.tomasu.net Port 80
pNVYjj";$΁4E\N@)Ii` ? p?>sM& $BP=hI] 'y<1QpNVrr";$΁4EdT@)|Ii`(? p?>sM& $-Kȱwnx 'yBpNV,$΁4";E|Ɓ@) 7iI`@:7& $ p?>sMqK]mpNV= !"#$%&'()*+,-./01234567pNVb rr$΁4";EdƂ@) NiI`(7& $ p?>sM-@0Kȱx7 1Q'yBpNVAd jj";$΁4E\l@)lIi` ? p?>sM& $-Kȱx@07 'y]1QpNVe uu";$΁4Egm@) `Ii`+? p?>sM& $-Kȱx@0ޯ 'y]1QVNVJr< ~_9 &QG+, # $rs/0'(vwz{/<5=A |}3g9kE2@8jDfUmail.tomasu.net#   pNV jj$΁4";E\ƃ@) UiI` 7& $ p?>sM-@0Kȳ<6  1Q'y]pNV $΁4";Eƅ@)ӸiI`7& $ p?>sM-@0KȳqR~0U0 U00U%0++0PU I0G0; +10+0)+https://secure.comodo.net/CPS0g 0TUM0K0IGEChttp://crl.comodoca.com/COMODORSADomainValidationSecureServerCA.crl0+y0w0O+0Chttp://crt.comodoca.com/COMODORSADomainValidationSecureServerCA.crt0$+0http://ocsp.comodoca.com0/U(0&mail.tomasu.netwww.mail.tomasu.net0  *H  ^yw Mc#mWÎ)͖< 7@s ;,.d/ݝqrtSX `)ް1X*[(}v*೾e&sM& $-Kȳ@0/ 'yx1QpNVx $΁4";EƆ@)ҸiI`7& $ p?>sM-@0Kȳ IKی ^e> L°E^R/4H$dAgޞzS;|UoG |"Wp`-{*(!MoO%z5&FЬY5NCP?YlQ!XuPx>Lk;R$n'QEp%C J~m.'s]E0A Dڹ兂e0a0U#0~=<8220Uj:Z ؐVsC:(0U0U00U%0++0U 00U 0g 0LUE0C0A?=;http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q+e0c0;+0/http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$+0http://ocsp.comodoca.com0  *H  N+vOb6w'D>ff>I5ݕ56uPr|w ʣg.V{DB] PFYl݌:BK4{';o$;rctX<l?OȨ7El^&뭣 f5s2`N݊a,nRwhuQt8C(]G'`8;lrBoEٵsx#lT|UI^d>iͿHb FW3cJϏR >Qtt.Sz&Ҡ7[(;1W-ZpNV jj$΁4";E\Ɔ@)RiI` 7& $ p?>sM-@0Kȳ< 1Q'y]y^ f9C$=` [CGK՚_ԇŒ07B攨$QΒP@{Yݬw4ؐ-7`g B Ehf$7)F%Ԇ(jDp&#bopVwx%Pr:c4q ox0t0\'fVIp"0  *H  0o1 0 USE10U  AddTrust AB1&0$U AddTrust External TTP Network1"0 UAddTrust External CA Root0 000530104838Z 200530104838Z01 0 UGB10UGreater Manchester10USalford10U COMODO CA Limited1+0)U"COMODO RSA Certification Authority0"0  *H 0 T V $Dgt+7}#pqS*KVpraK=a> >\4zk眳zvq l߰~Ħ/OgCr ։k,폘~nب$CkbUllixH0Eխ |3WAsM& $-Kȳ@0 * 'yx1QpNV jj";$΁4E\@)TIi` ? p?>sM& $-Kȳ@0 %  'yx1QpNV 77$΁4";E)Ƈ@)iI`7& $ p?>sM-@0KȳvnRp\.HMȩs{#ޢMUzaEh^@k#yzkoF{=KؓYZA$`XGnF_ظ@͗9܇Ѧ;o8o:0600  *H 0o1 0 USE10U  AddTrust AB1&0$U AddTrust External TTP Network1"0 UAddTrust External CA Root0 000530104838Z 200530104838Z0o1 0 USE10U  AddTrust AB1&0$U AddTrust External TTP Network1"0 UAddTrust External CA Root0"0  *H 0 3-9N[l͵#ޛ3)L}JmPZ֗)ZIz.ʿ78->ApVO?2tȐT_x@<a^jPךNqqP` 8i&LO#:OΟioBkDǭmA_rZq7yeY7/ ’r8rE]*}D+C%aijX#3VuY)F +eBo{]S4Z'00Uz4&&T$T0 U0U00U#0z4&&T$Tsq0o1 0 USE10U  AddTrust AB1&0$U AddTrust External TTP Network1"0 UAddTrust External CA Root0  *H %#Aلy[#6ewAlG`Q2=&ǀZxy!L 5QҖ~Np9 Q-Fu$Bpg5J+zQBzc满+6 c~y{ @jݏBQEb!h C<|$ةs?V18q.ጘ1DLsIv`k.LZy .՞c&U؂Z{мǏNM IAY+UsM}ԑXdfFoXGX5u7%fWߥ+uV(% O+Ќ*!nBOdHmߵ~Ε]:~F?#*;"нM E%0CQ[}{M$Eos*#a&M47炦d騉n׫n8ÒP^*>kZnV%O#¯41~ϲ-07m&le*m~ y7ְVNǪM?B :G}t-AB@y͚VTapNV jj";$΁4E\@)SIi` ? p?>sM& $-Kȳ@0S<  'yx1QpNV" ";$΁4Eڽ@)ԮIi`? p?>sM& $-Kȳ@0SsM-@0SKȴ<>U 1R'yy,Ѕ]F*Aم86\]bKv 9SFGlr.%@R4ߖ5$B0N=daT?F'ĒёQVzg×sGh>?6j.uvpTMNP,<@ X5rW<&+ YDk%c wҾF!tɚX ݻ'tZ(3p|"DgpvQ7AP[r-,YއpNVN ";$΁4E@)Ii`? p?>sM& $-Kȴ@0eR 'y1R6m<Ŋ +&#D61APޘ)ݾO"=_>NXJ8` b/EWэ|az#]I;=sLhc[^bOA3JQHVGf}e5(i+sFpNV$΁4";EƋ@)͸iI`7& $ p?>sM-@0eKȴ@~ 1R<'yP3p|펜m=yz_f9 x,v R4-y͢&BA?Xl?XS]??cGdCFfJǫ7xL]|75ޱG(lJ얎sLjOw4iI4YN},7URss+@ h~aUЫޤpBdh%:sy?F[H#˵էS>Z_fy3p|V.؈R^o43p|j'p@ԇ%ƼTVnbEI2b>eyp4fd x(^':K=XhWD%$R!86ߛd$Z@X.6;,5h;&+3!**єLSvK/X6sPks|F>zG+w W*!qh}H} hs,wXc· ?vjr21!c٧'`C癕0/ܰ%/tN#Mɛ["EEto9Nz1r:D,O1w`)xFtܨԸd1&CiڧuvuwegwQR)Őz`3NrZO Ĕ-yi̗?tJB"UF[{(礓yZ[6kO2Ք۪YL e;(FUؚ@p$lhf\"8vHX#Eucg ,ul}cpY!">9ULO( ڂE,'Žo70NКfA!3H pNVjj";$΁4E\@)+Ii` ? p?>sM& $BP=hH 'yﷴ1QpNVz$΁4";Eƌ@)̸iI`7& $ p?>sM-@0Kȴ@Ҩ 1R<'yYXqO #07@tE:ƅ\3 1$zX=VdMoPgXk 7k Rhؗt鸥2GN)ܧK_Z =aKy0ۂfcE a{/z pv+%5KbXlY5]6\Tq+)K/#8>|~R HC)'bep"A8ePgUB μegLy~e,[ŷrqjm~,Dx{B6s=ձUzF%>:ϋU+^kNlIX(AtZ!ڤMFR+TFdCBzc328i0e+x1XW =8[s>?, =vh4U=),jvѽ#{t)Jt>ۈbj%L:ʤj.[Gg_l&;o~B+1/uu6ض;3w53]oim"{gh97)k^<>#k\XB e[͍ S/Vhoa^iz.WCX`\z\^cG1tVV٣xjIĸϣ~7-ZA:Vcg]=5"3eٹe &/SDhx *7UnB]7n9o ];Rˉ- Ţ&dsIt-;gu$%Un0A>x0FB|BMDD1_j]\7XzS. DO4A~$LVo(GFeV % y'ȸWjآ0櫦sM-@0eKȴ@ 1R<'yF(0I7[N.xgw<ׇAGΥLyR,aI ;O.4l=4a?zJ3G*];vdY^ V]w{neiX0PPd,S! 6ohEWhB=[e?$OTβ:a2H9rY86:8?2٨bC&Vcy+-=Ѭ7Øo[ցbˍQBZjf=>El3<9Vp$`vүo6yni'(+y8ĺKǿd~mi{Ju2ew[ nW08geCN~s5V[l 4}ޮZ*Hys hْ>|0 ȣ맪fbE?4΁;|K#JoZ!ѕ`;#47瞟ر=52j- .2=Y㥗~ E~:m$khMRuለ섒ۍN1$/R$ ^"savc BtU |񽁟I1m`2ƿ~.uA='>-,O#6d4-i1W&eosq C\Q)f^I$=8s+jtbWQݺ+ƒ k0/e5S=Ptԡ'hW{={- _Q?TJKO9٣uVZeٯ0ͫBǪi Q\fyrU6g Ƅ`ur:\}Le@Ck< KkNyq/%5ehjVŒ@~fz+v` 6>Lmd%qA^ll!kK&p+rH*&6E5cLNZ EK2o{uV|h ;ԝocTS3T_95^O+?3f!trv_!:( [~!NOKH&>ɍH=U{>Ck]`:IyVr9BwJ 6Z~OܝzwkpkIR||̛7e"xKB' hYYַuHX9GC]KSҤ\t%hNZg~ y扤k`,;[VQکjspKU!0$b2c}.h?vz2٩Lܠ~^MqOnaEzI6Ј(-GaQ>@!o MD!z|!^ d iU'pNVjj";$΁4E\@)*Ii` ? p?>sM& $-Kȴ@0e~# 'y︴1RsM-@0Kȴ@ 1R<'y"!P(4~bhb\sV#)Kc"CSl{'<njPgJP̿6&<47sTbb㟓9NN)vߓuȐy1~c|Z Jnpbv<-9knK9g Zy>I-~n4kZu?eK#n)rd!JKE/g~귻H3w%wk$c%L!Ợ8/ hg'^4H%{gy["N f.oN]2." lY70"4OleiT*]FFW}to̒V^4e6Bra")Hp Ɣ!8DR+c`*ſ@\C/B~Iٖ[`c&j)>;d[԰`GJ ~YU\d@߲QȝJ;P,@Ja5,T1G50҈e#x-fTv[KEZ=z>eP-X3ZA p kpى)WagAa\ [.p]pl.{j+mG7\jEbvBwrù.*.#T$`1gԻ_pw҆d=qHf/kO^ctIo1f?ao|]~5ʲg ɐD.ToF[!My6QnZ* t 'O%uhQV ֊o4PoZm .n#z9'etQURh=Nk]{\`tiTwWp<1'6x~~b&|?pj;58dV{1ƽI]RfZls?[ver !标q:eO5H 7F/d;Gޙy#%ytR${Gj[ Qd 1Z]_`y׹&rMm͕'w 6Ÿ~ w&푟ލIo#y-?! gߨ hn6nD Q  q^1úA/<3pNV$΁4";E{Ǝ@) +iI`?7& $ p?>sM-@0ĎKȴ@!  1R<'y3p|WG*Iw?"/pNVjj";$΁4E\@))Ii` ? p?>sM& $-Kȴ@0Ď 'yﺴ1RsM-@0ĭKȴ@ 1R@'y3p|TWC Q 'cdpNV(jj";$΁4E\@)(Ii` ? p?>sM& $-Kȴ@0π 'yＴ1RsM& $-Kȴ@0π 'yＴ1RsMPB=hsM& $BP=iH/ 'yҴ1RVqNVjj$΁4";E\Ƒ@) GiI` 7& $ p?>sM-@0Kȴ@ 1R['yqNVjj";$΁4E\@)Ii` ? p?>sM& $-Kȴ@0ЀM 'y״1R[qNVFF";$΁4E|@)ϮIi`@:? p?>sM& $C]nqNVC !"#$%&'()*+,-./01234567qNV$΁4";E|ƒ@) &iI`@:7& $ p?>sMC]nqNVC !"#$%&'()*+,-./01234567rNVH";$΁4E|@)Ii`@:? p?>sM& $<@]orNV7F !"#$%&'()*+,-./01234567rNV'$΁4";E|Ɠ@) %iI`@:7& $ p?>sM;@]orNV7F !"#$%&'()*+,-./01234567sNVM";$΁4E|@) Ii`@:? p?>sM& $9:]psNV9K !"#$%&'()*+,-./01234567sNV$΁4";E|Ɣ@) $iI`@:7& $ p?>sM8:]psNV9K !"#$%&'()*+,-./01234567nDPI-2.2/tests/pcap/BGP_Cisco_hdlc_slarp.pcap000066400000000000000000000023011321103654100210140ustar00rootroot00000000000000ò KX#V00E,@VddGu`@KX#V600E,?jddGYu`@&KX#VR,,E(@YddGuYӀP@=KX#V#ReeEa@ddGuYӀP@u9 FAKX#V,,E(?mddGYӀv P?=KX#VeeEa@2ddGYӀv P?(9nnnnFAKX#V&??E;@WddGYӹv P?9lKX#VҠ,,E(@WddGv YP?=KX#V??E;@CddGv YP?9lKX#VCCE?@RddGY̼vP?6PKX#VGE@ddGYvP?u9@@ @ddd 0@@ @dKX#VC,,E(@UddGvYzP?=|X#Vb ??E;@TddGYzvP?8}X#V,,E(@TddGvYԍP>=nDPI-2.2/tests/pcap/BGP_redist.pcap000066400000000000000000000005721321103654100170630ustar00rootroot00000000000000ò hJG-E@/ըlI 302 Moved

302 Moved

The document has moved here. gUK 66E(@@F w0P8{6DŽP;qgU 66E(@;Эw0 PDŽ8{6PgU 66E(@@F w0P8{6DŽP;qgU JJE<@@ wPW9 gU 66E(@;w PRBWPgU= 66E( @@ wPWRCP9gUu E @@W wPWRCP9DGET /?gfe_rd=cr&ei=1BxnVcP9OKKk8we50oDAAg HTTP/1.1 User-Agent: test Connection: close Host: www.google.com.br Accept-Encoding: gzip gU 66E(@;w PRCWIPgUE@6w PRCWIPRHTTP/1.1 200 OK Date: Thu, 28 May 2015 13:49:09 GMT Expires: -1 Cache-Control: private, max-age=0 Content-Type: text/html; charset=ISO-8859-1 Set-Cookie: PREF=ID=f3373cd6d2e25ba5:FF=0:TM=1432820949:LM=1432820949:S=OZjW77lmG__Q5Kmq; expires=Sat, 27-May-2017 13:49:09 GMT; path=/; domain=.google.com.br Set-Cookie: NID=67=rqgs_bhWSk-wib3Ye5zq4f9pKorKgPbIkPJFMMH5RWwW9Ykskem1lOyZMAoSgpWpJjQc2qcVqXc0_lN8OO6ZwdacWsMYAJRu7QvkNdktESuIVF5v_dV9Vm0Focn_D91e; expires=Fri, 27-Nov-2015 13:49:09 GMT; path=/; domain=.google.com.br; HttpOnly P3P: CP="This is not a P3P policy! See http://www.google.com/support/accounts/bin/answer.py?hl=en&answer=151657 for more info." Server: gws X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Alternate-Protocol: 80:quic,p=0 Accept-Ranges: none Vary: Accept-Encoding Connection: close Google