Smarter application detection and deeper traffic analysis, now on more platforms

Application detection

We now identify applications by their actual traffic, not by the port they use. This covers more than 250 protocols, so SSH running on an unusual port is still recognized as SSH. The full list is at the end of this post.

We read both the request and the response, so a connection is labeled by what it really turned out to be. A mail session that switches to encryption is labeled as encrypted mail. A proxy connection keeps its proxy label instead of being renamed after the traffic it carries.

This also lets us spot protocol masquerading, such as SSH or an unknown protocol running on port 443.

Client and server roles now come from the content of the conversation, including for UDP. Far fewer connections are shown in the wrong direction.

Service names are now short and consistent. When the port and the actual traffic don't match, you see both, for example "https (ssh)".

we identify bittorent by its traffic, not its port

Groundwork for vulnerability detection

We now collect protocol versions such as TLS/SSL, SSH and SMB dialects. We also collect the software name and version that servers announce about themselves, such as OpenSSH, FTP, mail and database servers. This data will feed upcoming detections of vulnerable and outdated applications.

Why connections ended

For every TCP connection we now record how it ended and which side ended it: a normal close, a reset or an idle timeout. We also catch abnormal behavior such as:

• stealth scan probes and illegal flag combinations
• injected or unexpected resets
• traffic sent after a connection was closed
• connections that stalled because one side stopped accepting data

This helps with attack detection and with everyday network troubleshooting.

ICMP errors linked to the traffic they are about

ICMP errors such as "unreachable" and "time exceeded" carry part of the original packet. We now read that packet and link the error to the exact connection that failed. These errors now appear in reports and detections.

More accurate traffic processing

We rebuilt the duplicate packet filter, and it is much faster. Changes made by the network along the way, such as MAC addresses, TTL and checksums, no longer confuse it. Real retransmissions are now counted instead of dropped, so repeated connection attempts show their true number.

We also made many session reassembly fixes, covering:

• fragmented packets
• IPv6
• DNS
• PPPoE
• ping traffic

The online pcap analyzer and the live collector now follow the same rules, so the same traffic gives the same result either way.

Detections

Self-assigned (APIPA, 169.254.x.x) and IPv6 link-local addresses are now tracked as endpoints and covered by detections. They often point to misconfigured or rogue devices.

We fixed several detection rules that reported the wrong technique or missed findings. Reports can also show how popular a domain is among the top 1 million sites, not only the top 10,000.

Threat intelligence

We added new phishing and crypto scam domain feeds. We also added context on:

• internet scanners
• search and AI crawlers
• dynamic DNS providers
• iCloud Private Relay

There are fewer false positives on major cloud services, CDNs and popular sites, and the daily intelligence updates are more reliable.

Speed and reliability

Online pcap analysis is quicker, and small captures finish noticeably sooner. Live reports now update in real time. The collector handles network drops and reconnects without losing data.

New platforms

The collector now runs natively on Windows ARM and Linux ARM.

Appendix. Protocols we recognize

263 protocols, grouped by what they are used for.

Web and proxies (15)

HTTP, HTTP/2, TLS / SSL, DTLS, QUIC, WebSocket, HTTP CONNECT tunnel, HTTP proxy, SOCKS (4 and 5), HAProxy PROXY protocol, Apache JServ Protocol (AJP), FastCGI, WebDAV, JSON-RPC, SOAP

Mail and news (7)

SMTP, SMTPS / SMTP with STARTTLS, IMAP, IMAPS / IMAP with STARTTLS, POP3, POP3S / POP3 with STLS, NNTP (Usenet)

Remote access (12)

SSH, RDP, VNC (RFB), Telnet, TeamViewer, Radmin, NoMachine (NX), VMware Remote Console, Citrix ICA, XDMCP (X11 login), PowerShell Remoting, IPMI (RMCP)

File sharing and transfer (15)

SMB 1, SMB 2 / 3, NFS, Apple Filing Protocol (AFP), FTP, FTP data channel, FTPS / FTP with AUTH TLS, TFTP, rsync, Syncthing, Dropbox LAN Sync, FLUTE, UFTP, Ceph, Lustre

Peer-to-peer (3)

BitTorrent, eDonkey / eMule, Gnutella

Windows and directory services (6)

Kerberos, LDAP, NetBIOS (name, datagram and session), DCE/RPC (MS-RPC), RPC over HTTP (MS-RPCH), Windows Delivery Optimization

Core network services (16)

DNSCrypt, DHCP, DHCPv6, NTP, PTP (IEEE 1588v2), Roughtime, SNMP, Syslog, SSDP (UPnP discovery), WS-Discovery, Service Location Protocol (SLP), NAT-PMP, STUN, Teredo, WHOIS, Z39.50

Routing and network infrastructure (16)

BGP, BFD, LDP (MPLS), LISP, HSRP, GLBP, VXLAN, OpenFlow, CAPWAP (wireless controllers), Cisco Meraki cloud, Ubiquiti discovery, HP Virtual Group, Check Point ClusterXL (CPHA), RADIUS, Diameter, DLEP

Mobile core (4G/5G) (5)

GTP, GTP-C, GTP-U, GTP', PFCP

Monitoring (9)

NetFlow, sFlow, Zabbix, Checkmk, Munin, collectd, Kismet, RIPE Atlas, Ookla Speedtest

VPN and tunnels (17)

IPsec (IKE), OpenVPN, WireGuard, PPTP, Cisco VPN, SoftEther VPN, Tailscale, Nebula, tinc, LogMeIn Hamachi, NetMotion Mobility, Yggdrasil, UltraSurf, Meshtastic, Mudfish, GearUP Booster, LagoFast

Databases and caches (11)

MySQL / MariaDB, PostgreSQL, Microsoft SQL Server (TDS), Oracle Database (TNS), IBM Db2 (DRDA), MongoDB, Apache Cassandra, Redis, Memcached, Elasticsearch, InterSystems IRIS

Messaging and RPC middleware (19)

MQTT, AMQP, Apache Kafka, NATS, STOMP, ActiveMQ OpenWire, ZeroMQ, Apache Thrift, CORBA (GIOP), Java RMI, DDS (RTPS), SOME/IP, Gearman, AFS Rx, FIX (financial trading), Simple Binary Encoding (SBE), KCP, Raft, JSON over TCP/UDP

Industrial control (ICS/SCADA) (27)

Modbus/TCP, Schneider UMAS, DNP3, IEC 60870-5-104, MMS (IEC 61850), IEEE C37.118 (synchrophasors), Siemens S7comm, Siemens S7comm-plus, PROFINET IO, EtherNet/IP, CIP, OPC UA, BACnet, KNXnet/IP, Omron FINS, Mitsubishi MELSEC, Beckhoff ADS, Saia Ether-S-Bus, Ether-SIO, Ethernet Global Data (GE), HART-IP, Triconex TriStation, Automatic Tank Gauge (ATG), CAN over IP, LonWorks CNP/IP, TRDP (rail), HiSLIP (test instruments)

Smart meters and IoT (11)

ANSI C12.22, IEC 62056 (DLMS/COSEM), CoAP, Matter, Tuya, TP-Link Smart Home, Google Nest, Samsung SDP, EasyWeather, TiVo Connect, Canon BJNP (printers)

Voice and video calls (14)

SIP, RTP, RTCP, H.323, MGCP, Megaco (H.248), IAX2 (Asterisk), Cisco SCCP (Skinny), Alcatel-Lucent NOE, BFCP, Zoom, imo, Mumble, TeamSpeak

Streaming and media (7)

RTSP, RTMP, MPEG-TS, Agora SD-RTN, Spotify, Amazon Prime Video, iQIYI

Chat and messaging apps (11)

IRC, XMPP (Jabber), WhatsApp, Telegram, Viber, Discord, Tencent QQ, OICQ (legacy QQ), DingTalk, Paltalk, SMPP (SMS gateways)

Collaboration and cloud (6)

Git, HCL Notes (Lotus Notes), Alibaba Cloud, Xiaomi cloud services, Avast, Avast Secure DNS

Crypto and blockchain (6)

Bitcoin, Ethereum, Monero, Nano, Casper (ZUG), Crypto mining (Stratum)

Healthcare (2)

DICOM, HL7

Games (28)

Steam, Steam Datagram Relay, Valve Source Engine, Xbox Live, Nintendo Switch Online, Blizzard Battle.net, World of Warcraft, Heroes of the Storm, Activision, Call of Duty Mobile, League of Legends Wild Rift, Genshin Impact, Among Us, Free Fire, Path of Exile, Guild Wars 2, The Elder Scrolls Online, Gaijin (War Thunder), Tencent Games, NetEase Games, Nexon, Dofus, Toca Boca, CrossFire, Armagetron Advanced, CryEngine networking, RakNet, Yojimbo