Hi Steve, Thanks very much for this feedback and for reporting the error in the docs in the separate email. Those unknown come from the so-called 'master protocol' in nDPI, we may understand why you are getting those.
I propose to continue 1:1 on any of issues/feedback related to nDPI so not to monopolise the list for this specific topic. I received interest into the effort and some feedback also from a few more people, it may make sense to create a separate 'pmacct-nDPI integration beta testers' list. Paolo On Tue, Jul 25, 2017 at 01:51:32PM -0400, Stephen Clark wrote: > Hi Paolo, > > I did a minimal test of the new nDPI integration. It looks promising. > > What is the first Unknown suppose to represent? > Unknown/Kerberos > Unknown/Kerberos > Unknown/Kerberos > > This is a little confusing - this was traffic between the same host - very > close > together but > only one is identified as SSL traffic. > Unknown/Unknown 443 57137 tcp 0 8 > 8618 > Unknown/SSL 443 57137 tcp 0 2848 > 3076024 > > Some feedback, > > Thanks, > Steve > > > _______________________________________________ > pmacct-discussion mailing list > http://www.pmacct.net/#mailinglists _______________________________________________ pmacct-discussion mailing list http://www.pmacct.net/#mailinglists