Smarter application detection and deeper traffic analysis, now on more platforms
Traffic-based detection for 250+ protocols, clearer connection diagnostics, richer software and version details, improved detections and threat intelligence, and faster PCAP and live traffic analysis.
Application detection
We now identify applications by their actual traffic, not by the port they use. This covers more than 250 protocols, so SSH running on an unusual port is still recognized as SSH. The full list is at the end of this post.
We read both the request and the response, so a connection is labeled by what it really turned out to be. A mail session that switches to encryption is labeled as encrypted mail. A proxy connection keeps its proxy label instead of being renamed after the traffic it carries.
This also lets us spot protocol masquerading, such as SSH or an unknown protocol running on port 443.
Client and server roles now come from the content of the conversation, including for UDP. Far fewer connections are shown in the wrong direction.
Service names are now short and consistent. When the port and the actual traffic don't match, you see both, for example "https (ssh)".
we identify bittorent by its traffic, not its port
Groundwork for vulnerability detection
We now collect protocol versions such as TLS/SSL, SSH and SMB dialects. We also collect the software name and version that servers announce about themselves, such as OpenSSH, FTP, mail and database servers. This data will feed upcoming detections of vulnerable and outdated applications.
Why connections ended
For every TCP connection we now record how it ended and which side ended it: a normal close, a reset or an idle timeout. We also catch abnormal behavior such as:
- stealth scan probes and illegal flag combinations
- injected or unexpected resets
- traffic sent after a connection was closed
- connections that stalled because one side stopped accepting data
This helps with attack detection and with everyday network troubleshooting.
ICMP errors linked to the traffic they are about
ICMP errors such as "unreachable" and "time exceeded" carry part of the original packet. We now read that packet and link the error to the exact connection that failed. These errors now appear in reports and detections.
More accurate traffic processing
We rebuilt the duplicate packet filter, and it is much faster. Changes made by the network along the way, such as MAC addresses, TTL and checksums, no longer confuse it. Real retransmissions are now counted instead of dropped, so repeated connection attempts show their true number.
We also made many session reassembly fixes, covering:
- fragmented packets
- IPv6
- DNS
- PPPoE
- ping traffic
The online pcap analyzer and the live collector now follow the same rules, so the same traffic gives the same result either way.
Detections
Self-assigned (APIPA, 169.254.x.x) and IPv6 link-local addresses are now tracked as endpoints and covered by detections. They often point to misconfigured or rogue devices.
We fixed several detection rules that reported the wrong technique or missed findings. Reports can also show how popular a domain is among the top 1 million sites, not only the top 10,000.
Threat intelligence
We added new phishing and crypto scam domain feeds. We also added context on:
- internet scanners
- search and AI crawlers
- dynamic DNS providers
- iCloud Private Relay
There are fewer false positives on major cloud services, CDNs and popular sites, and the daily intelligence updates are more reliable.
Speed and reliability
Online pcap analysis is quicker, and small captures finish noticeably sooner. Live reports now update in real time. The collector handles network drops and reconnects without losing data.
New platforms
The collector now runs natively on Windows ARM and Linux ARM.
Appendix. Protocols we recognize
263 protocols, grouped by what they are used for.
Web and proxies (15)
HTTP, HTTP/2, TLS / SSL, DTLS, QUIC, WebSocket, HTTP CONNECT tunnel, HTTP proxy, SOCKS (4 and 5), HAProxy PROXY protocol, Apache JServ Protocol (AJP), FastCGI, WebDAV, JSON-RPC, SOAP
Mail and news (7)
SMTP, SMTPS / SMTP with STARTTLS, IMAP, IMAPS / IMAP with STARTTLS, POP3, POP3S / POP3 with STLS, NNTP (Usenet)
Remote access (12)
SSH, RDP, VNC (RFB), Telnet, TeamViewer, Radmin, NoMachine (NX), VMware Remote Console, Citrix ICA, XDMCP (X11 login), PowerShell Remoting, IPMI (RMCP)
File sharing and transfer (15)
SMB 1, SMB 2 / 3, NFS, Apple Filing Protocol (AFP), FTP, FTP data channel, FTPS / FTP with AUTH TLS, TFTP, rsync, Syncthing, Dropbox LAN Sync, FLUTE, UFTP, Ceph, Lustre
Peer-to-peer (3)
BitTorrent, eDonkey / eMule, Gnutella
Windows and directory services (6)
Kerberos, LDAP, NetBIOS (name, datagram and session), DCE/RPC (MS-RPC), RPC over HTTP (MS-RPCH), Windows Delivery Optimization
Core network services (16)
DNSCrypt, DHCP, DHCPv6, NTP, PTP (IEEE 1588v2), Roughtime, SNMP, Syslog, SSDP (UPnP discovery), WS-Discovery, Service Location Protocol (SLP), NAT-PMP, STUN, Teredo, WHOIS, Z39.50
Routing and network infrastructure (16)
BGP, BFD, LDP (MPLS), LISP, HSRP, GLBP, VXLAN, OpenFlow, CAPWAP (wireless controllers), Cisco Meraki cloud, Ubiquiti discovery, HP Virtual Group, Check Point ClusterXL (CPHA), RADIUS, Diameter, DLEP
Mobile core (4G/5G) (5)
GTP, GTP-C, GTP-U, GTP', PFCP
Monitoring (9)
NetFlow, sFlow, Zabbix, Checkmk, Munin, collectd, Kismet, RIPE Atlas, Ookla Speedtest
VPN and tunnels (17)
IPsec (IKE), OpenVPN, WireGuard, PPTP, Cisco VPN, SoftEther VPN, Tailscale, Nebula, tinc, LogMeIn Hamachi, NetMotion Mobility, Yggdrasil, UltraSurf, Meshtastic, Mudfish, GearUP Booster, LagoFast
Databases and caches (11)
MySQL / MariaDB, PostgreSQL, Microsoft SQL Server (TDS), Oracle Database (TNS), IBM Db2 (DRDA), MongoDB, Apache Cassandra, Redis, Memcached, Elasticsearch, InterSystems IRIS
Messaging and RPC middleware (19)
MQTT, AMQP, Apache Kafka, NATS, STOMP, ActiveMQ OpenWire, ZeroMQ, Apache Thrift, CORBA (GIOP), Java RMI, DDS (RTPS), SOME/IP, Gearman, AFS Rx, FIX (financial trading), Simple Binary Encoding (SBE), KCP, Raft, JSON over TCP/UDP
Industrial control (ICS/SCADA) (27)
Modbus/TCP, Schneider UMAS, DNP3, IEC 60870-5-104, MMS (IEC 61850), IEEE C37.118 (synchrophasors), Siemens S7comm, Siemens S7comm-plus, PROFINET IO, EtherNet/IP, CIP, OPC UA, BACnet, KNXnet/IP, Omron FINS, Mitsubishi MELSEC, Beckhoff ADS, Saia Ether-S-Bus, Ether-SIO, Ethernet Global Data (GE), HART-IP, Triconex TriStation, Automatic Tank Gauge (ATG), CAN over IP, LonWorks CNP/IP, TRDP (rail), HiSLIP (test instruments)
Smart meters and IoT (11)
ANSI C12.22, IEC 62056 (DLMS/COSEM), CoAP, Matter, Tuya, TP-Link Smart Home, Google Nest, Samsung SDP, EasyWeather, TiVo Connect, Canon BJNP (printers)
Voice and video calls (14)
SIP, RTP, RTCP, H.323, MGCP, Megaco (H.248), IAX2 (Asterisk), Cisco SCCP (Skinny), Alcatel-Lucent NOE, BFCP, Zoom, imo, Mumble, TeamSpeak
Streaming and media (7)
RTSP, RTMP, MPEG-TS, Agora SD-RTN, Spotify, Amazon Prime Video, iQIYI
Chat and messaging apps (11)
IRC, XMPP (Jabber), WhatsApp, Telegram, Viber, Discord, Tencent QQ, OICQ (legacy QQ), DingTalk, Paltalk, SMPP (SMS gateways)
Collaboration and cloud (6)
Git, HCL Notes (Lotus Notes), Alibaba Cloud, Xiaomi cloud services, Avast, Avast Secure DNS
Crypto and blockchain (6)
Bitcoin, Ethereum, Monero, Nano, Casper (ZUG), Crypto mining (Stratum)
Healthcare (2)
DICOM, HL7
Games (28)
Steam, Steam Datagram Relay, Valve Source Engine, Xbox Live, Nintendo Switch Online, Blizzard Battle.net, World of Warcraft, Heroes of the Storm, Activision, Call of Duty Mobile, League of Legends Wild Rift, Genshin Impact, Among Us, Free Fire, Path of Exile, Guild Wars 2, The Elder Scrolls Online, Gaijin (War Thunder), Tencent Games, NetEase Games, Nexon, Dofus, Toca Boca, CrossFire, Armagetron Advanced, CryEngine networking, RakNet, Yojimbo