Skip to content

Commit

Permalink
Merge pull request elastic#192 from Shweta-Bhandare/qosmos180
Browse files Browse the repository at this point in the history 
Qosmos180
  • Loading branch information
@weberr13
weberr13 committed Jun 20, 2014
2 parents f676f1e + a4fd0b9 commit e391432
Show file tree
Hide file tree
Showing 7 changed files with 1,124 additions and 1,100 deletions.
2 changes: 2 additions & 0 deletions protofiles/Applications.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2309,4 +2309,6 @@ optional string pou = 2307 [default = "Mobile game"];
optional string subway_surfers = 2308 [default = "Mobile game"];
optional string addthis = 2309 [default = "AddThis is a social bookmarking service that can be integrated into a website with the use of a web widget."];
optional string amjilt = 2310 [default = "Mongolian news portal."];
optional string doodle_jump = 2311 [default = "Mobile game developped by Lima Sky LLC"];
optional string telegram = 2312 [default = "Telegram is an instant messaging protocol like Whatsapp."];
}
5 changes: 5 additions & 0 deletions protofiles/DpiMsgLRproto.proto
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2697,4 +2697,9 @@ optional uint32 sr_lsrQ_PROTO_RTCP = 3006; // QOSMOS:Q_PROTO_RTCP,Q_RTCP_SR_LSR
optional uint32 sr_dlsrQ_PROTO_RTCP = 3007; // QOSMOS:Q_PROTO_RTCP,Q_RTCP_SR_DLSR
optional string mapped_address_ipv4Q_PROTO_STUN = 3008; // QOSMOS:Q_PROTO_STUN,Q_STUN_MAPPED_ADDRESS_IPV4,uint32,ip_addrToString
optional string xor_mapped_address_ipv4Q_PROTO_STUN = 3009; // QOSMOS:Q_PROTO_STUN,Q_STUN_XOR_MAPPED_ADDRESS_IPV4,uint32,ip_addrToString
optional string framed_ip_netmaskQ_PROTO_RADIUS = 3010; // QOSMOS:Q_PROTO_RADIUS,Q_RADIUS_FRAMED_IP_NETMASK,uint32,ip_addrToString
optional uint32 magic_cookieQ_PROTO_STUN = 3011; // QOSMOS:Q_PROTO_STUN,Q_STUN_MAGIC_COOKIE
repeated bytes conference_idQ_PROTO_YMSG = 3012; // QOSMOS:Q_PROTO_YMSG,Q_YMSG_CONFERENCE_ID
repeated bytes video_typeQ_PROTO_YOUTUBE = 3013; // QOSMOS:Q_PROTO_YOUTUBE,Q_MPA_VIDEO_TYPE
optional uint32 video_avgdatarateQ_PROTO_YOUTUBE = 3014; // QOSMOS:Q_PROTO_YOUTUBE,Q_MPA_VIDEO_AVGDATARATE
}
2 changes: 2 additions & 0 deletions resources/Applications.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -2302,3 +2302,5 @@ pou,2307,"Mobile game"
subway_surfers,2308,"Mobile game"
addthis,2309,"AddThis is a social bookmarking service that can be integrated into a website with the use of a web widget."
amjilt,2310,"Mongolian news portal."
doodle_jump,2311,"Mobile game developped by Lima Sky LLC"
telegram,2312,"Telegram is an instant messaging protocol like Whatsapp."
3 changes: 3 additions & 0 deletions resources/NetMonFieldNames.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1735,6 +1735,7 @@ RADIUS,session_timeoutQ_PROTO_RADIUS,session_timeout,SessionTimeout,Session Time
RADIUS,start_timeQ_PROTO_RADIUS,start_time,StartTime,Start Time,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
RADIUS,stop_timeQ_PROTO_RADIUS,stop_time,StopTime,Stop Time,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
RADIUS,terminate_causeQ_PROTO_RADIUS,terminate_cause,TerminateCause,Terminate Cause,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
RADIUS,framed_ip_netmaskQ_PROTO_RADIUS,framed_ip_netmask,FramedIPNetmask,Framed IP Netmask,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
RAMBLER,domainQ_PROTO_RAMBLER,domain,Domain,Domain,domain,<domain>,Domain,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
RAMBLER,loginQ_PROTO_RAMBLER,login,Login,Login,login,<login>,Login,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
RAMBLER,passwordQ_PROTO_RAMBLER,password,Passwd,Password,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Expand Down Expand Up @@ -2171,6 +2172,7 @@ STP,root_addrQ_PROTO_STP,root_addr,RootAddr,Root Address,,,,,1st Review,,,,,,,,,
STP,root_path_costQ_PROTO_STP,root_path_cost,RootPathCost,Root Path Cost,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
STUN,mapped_address_ipv4Q_PROTO_STP,mapped_address_ipv4,MappedAddrIpV4Stun,Mapped Address IPV4 for Session Traversal Utilities for NAT,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
STUN,xor_mapped_address_ipv4Q_PROTO_STP,xor_mapped_address_ipv4,XorMappedAddrIpV4Stun,XOR Mapped Address IPV4 for Session Traversal Utilities for NAT,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
STUN,magic_cookieQ_PROTO_STP,magic_cookie,MagicCookie,Magic Cookie for Session Traversal Utilities for NAT,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
SYSLOG,codeQ_PROTO_SYSLOG,code,Code,Code,object,<object>,Object,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
T38,calleeQ_PROTO_T38,callee,Callee,Callee,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
T38,callerQ_PROTO_T38,caller,Caller,Caller,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Expand Down Expand Up @@ -2607,6 +2609,7 @@ YMSG_WEBMESSENGER,senderQ_PROTO_YMSG_WEBMESSENGER,sender,Sender,Sender,sender,<s
YMSG_WEBMESSENGER,serviceQ_PROTO_YMSG_WEBMESSENGER,service,Service,Service,process,<process>,Process,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
YMSG_WEBMESSENGER,sessionidQ_PROTO_YMSG_WEBMESSENGER,sessionid,SessionID,Session ID,processid,<processid>,Process ID,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
YMSG_WEBMESSENGER,versionQ_PROTO_YMSG_WEBMESSENGER,version,Version,Version,version,<version>,Version,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
YMSG_WEBMESSENGER,conference_idQ_PROTO_YMSG_WEBMESSENGER,conference_id,ConferenceId,Conference ID,conference_id,<conference_id>,ConferenceId,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
YOUTUBE,audio_datarateQ_PROTO_YOUTUBE,audio_datarate,AuditDataRate,Audio Data Rate,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
YOUTUBE,dateQ_PROTO_YOUTUBE,date,Date,Date,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
YOUTUBE,descriptionQ_PROTO_YOUTUBE,description,Description,Description,,,,,1st Review,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
Expand Down
2 changes: 2 additions & 0 deletions resources/ProtocolDescriptions.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,8 @@ pop3,Post Office Protocol (Version 3),#attach_content_decoded,Decoded attached f
qq,QQ,#call_data,QQ payload containing the data of the call (audio/video)
qq_transfer,QQ File Transfer,#content,File content
radius,Remote Authentication Dial-In User Service,#inherit_parent,"Parent inheritance key
radius,Remote Authentication Dial-In User Service,#framed_ipv6_prefix,Provides the ipv6 prefix to be configured for the user.
radius,Remote Authentication Dial-In User Service,#delegated_ipv6_prefix,Provides the ipv6 prefix to be delegated to the user.
radius,Remote Authentication Dial-In User Service,#avp_prefix,Ipv6 prefix is a sequence of 0 to 16 bytes. (CLEP_DATA_BUFFER)
rambler_webmail,Rambler webmail,#attach_content,Attached files' content.
rdp,Remote Desktop Protocol (Windows Terminal Server),#hostname_raw,"Client hostname
Expand Down
20 changes: 14 additions & 6 deletions resources/Qosmos_Protobook.csv
View file
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
9,Q_PROTO_AMQP,Middleware,amqp,Advance Message Queuing Protocol,2,Q_AMQP_MINOR_VERSION,minor_version,,uint32,Minor version of the protocol.,0,session_fix,0
9,Q_PROTO_AMQP,Middleware,amqp,Advance Message Queuing Protocol,3,Q_AMQP_METHOD,method,,string_index,Command launched.,0,session_mod,0
9,Q_PROTO_AMQP,Middleware,amqp,Advance Message Queuing Protocol,4,Q_AMQP_RESPONSE_TIME,response_time,,timeval,Server response time.,0,session_mod,0
563,Q_PROTO_APPLE_UPDATE,Web,apple_update,Apple Update,1,Q_APPLE_UPDATE_PKG_NAME,pkg_name,,string,pkg_name (package name) is the name of the software being updated.,0,session_fix,0
563,Q_PROTO_APPLE_UPDATE,Web,apple_update,Apple Update,1,Q_APPLE_UPDATE_PKG_NAME,pkg_name,,string,pkg_name (package name) is the name of the software being updated.,0,session_mod,0
1106,Q_PROTO_APPSTORE,Application Service,appstore,Apple App Store,3,Q_APPSTORE_DEVICE_TYPE,device_type,,string,"Target device (iPhone, iPod,...).",0,session_mod,0
1106,Q_PROTO_APPSTORE,Application Service,appstore,Apple App Store,2,Q_APPSTORE_CONNECTION_TYPE,connection_type,,string,Type of the connection.,0,session_mod,0
1106,Q_PROTO_APPSTORE,Application Service,appstore,Apple App Store,1,Q_APPSTORE_APPLICATION_NAME,application_name,,string,Name of the downloaded app.,0,session_mod,0
Expand Down Expand Up @@ -499,6 +499,7 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
32,Q_PROTO_DNS,Network Service,dns,Domain Name Service,15,Q_DNS_REPLY_CODE,reply_code,,string_index,Return Message,0,session_mod,0
32,Q_PROTO_DNS,Network Service,dns,Domain Name Service,16,Q_DNS_RESPONSE_TIME,response_time,,timeval,Elapsed time between sending of the dns request and reception of its response.,0,session_mod,0
32,Q_PROTO_DNS,Network Service,dns,Domain Name Service,17,Q_DNS_TTL,ttl,,uint32,Time (in seconds) a DNS information returned by the server will be kept in cache.,0,session_mod,0
32,Q_PROTO_DNS,Network Service,dns,Domain Name Service,67,Q_DNS_WEB_APPLICATION_INFO,web_application_info,,,"Structure containing metadata for classification of known HTTP-based web applications. These metadata are based on Type A (IPv4) DNS responses returned from the server. The ul3l4_addr_t structure contains the web application protocol path, classified using the requested host name, and the IPv4 address resolved by the server. The hostname lookup is performed on Q_HTTP_SERVER registered PDATA signatures only.",0,session_mod,0
34,Q_PROTO_EBAY,Web,ebay,eBay.com,617,Q_MPA_END,end,,ptr,Indicates the end of a top level event.,0,session_mod,0
34,Q_PROTO_EBAY,Web,ebay,eBay.com,581,Q_MPA_QUERY,query,,parent,Contains the raw and text query sent.,0,session_mod,0
34,Q_PROTO_EBAY,Web,ebay,eBay.com,583,Q_MPA_QUERY_TEXT,query_text,,string,Query sent to the search engine.,0,session_prt,0
Expand Down Expand Up @@ -652,11 +653,11 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
524,Q_PROTO_FACEBOOK_MAIL,Webmail,facebook_mail,facebook mail,630,Q_MPA_ACCOUNT,account,,parent,User account metadata including the login and the password.,0,session_mod,0
524,Q_PROTO_FACEBOOK_MAIL,Webmail,facebook_mail,facebook mail,739,Q_MPA_SESSION_ID,session_id,,string,Uniquely identifies the current user session.,0,session_mod,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,617,Q_MPA_END,end,,ptr,Indicates the end of a top level event.,0,session_mod,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,800,Q_MPA_SERVICE_DURATION_TV,service_duration_tv,,timeval,"Timeval structure indicating, when the service is ended, the length of it in second and microseconds.",0,session_prt,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,797,Q_MPA_SERVICE_DURATION,service_duration,,uint32,"4 bytes integer value indicating, when the service is ended, the duration of it in seconds",0,session_prt,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,798,Q_MPA_SERVICE_INFO,service_info,,parent,Parent attribute for service information.,0,session_mod,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,789,Q_MPA_SERVICE_ID,service_id,,uint32,"Composite 32-bit integer value defining the service currently used. The first byte (LSB) gives the generic service definition, the second byte gives an advanced service definition for File Transfer.",0,session_prt,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,604,Q_MPA_SERVICE,service,,string,Current service identification string. The service is re-evaluated every 5 seconds. This attribute is extracted only when the service changes.,0,session_prt,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,798,Q_MPA_SERVICE_INFO,service_info,,parent,Parent attribute for service information.,0,session_mod,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,797,Q_MPA_SERVICE_DURATION,service_duration,,uint32,"4 bytes integer value indicating, when the service is ended, the duration of it in seconds",0,session_prt,0
1117,Q_PROTO_FACETIME,Audio/Video,facetime,Apple FaceTime,800,Q_MPA_SERVICE_DURATION_TV,service_duration_tv,,timeval,"Timeval structure indicating, when the service is ended, the length of it in second and microseconds.",0,session_prt,0
556,Q_PROTO_FIREFOX_UPDATE,Web,firefox_update,Firefox Update,617,Q_MPA_END,end,,ptr,Indicates the end of a top level event.,0,session_mod,0
556,Q_PROTO_FIREFOX_UPDATE,Web,firefox_update,Firefox Update,3,Q_FIREFOX_UPDATE_PLUGIN_NEW_VERSION,plugin_new_version,,string,Plugin version after update.,0,session_mod,0
556,Q_PROTO_FIREFOX_UPDATE,Web,firefox_update,Firefox Update,2,Q_FIREFOX_UPDATE_PLUGIN_NAME,plugin_name,,string,Name of the plugin.,0,session_mod,0
Expand Down Expand Up @@ -1741,8 +1742,8 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
1124,Q_PROTO_LINE,Instant Messaging,line,Line,705,Q_MPA_CALLER_ADDR,caller_addr,,ip_addr,Address which could be used by the initiator of the call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,524,Q_MPA_CALLER,caller,,string,Contains the identity (or the phone number) of the initiator of the call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,523,Q_MPA_CALLEE,callee,,string,Contains the identity (or the phone number) of the called party for a call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,2,Q_LINE_CALL_BYTE_COUNT,call_byte_count,,uint32,The count of bytes that were exchanged during the call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,1,Q_LINE_CALL_PKT_COUNT,call_pkt_count,,uint32,The count of data packets that were exchanged during the call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,2,Q_LINE_CALL_BYTE_COUNT,call_byte_count,,uint32,(Deprecated) The count of bytes that were exchanged during the call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,1,Q_LINE_CALL_PKT_COUNT,call_pkt_count,,uint32,(Deprecated) The count of data packets that were exchanged during the call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,709,Q_MPA_START_TIME,start_time,,string,Start date of the call.,0,session_mod,0
1124,Q_PROTO_LINE,Instant Messaging,line,Line,521,Q_MPA_CALL_DURATION,call_duration,,uint32,Call duration.,0,session_mod,0
305,Q_PROTO_LINKEDIN,Forum,linkedin,LinkedIn.com,617,Q_MPA_END,end,,ptr,Indicates the end of a top level event.,0,session_mod,0
Expand Down Expand Up @@ -2635,6 +2636,7 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,550,Q_MPA_LOGIN,login,,string,User's login string.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,1,Q_RADIUS_CALLING_STATION_ID,calling_station_id,,string,Client id.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,2,Q_RADIUS_FRAMED_IP,framed_ip,,ip_addr,IP address.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,47,Q_RADIUS_FRAMED_IP_NETMASK,framed_ip_netmask,,ip_addr,IP netmask.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,3,Q_RADIUS_ACCT_SESSION_ID,acct_session_id,,string,Accounting session ID.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,4,Q_RADIUS_STATUS,status,,string_index,Status.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,5,Q_RADIUS_CODE,code,,uint8,Radius message code.,0,session_prt,0
Expand All @@ -2657,6 +2659,8 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,26,Q_RADIUS_LOGIN_IPV6_HOST,login_ipv6_host,,ip6_addr,Indicates the system with which to connect the user.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,27,Q_RADIUS_FRAMED_IPV6_ROUTE,framed_ipv6_route,,string,Provides the routing information to be configured for the user on the NAS,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,28,Q_RADIUS_FRAMED_IPV6_POOL,framed_ipv6_pool,,string,Contains the name of an assigned pool that SHOULD be used to assign an IPv6 prefix for the user.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,25,Q_RADIUS_FRAMED_IPV6_PREFIX,framed_ipv6_prefix,,buffer,Provides the ipv6 prefix to be configured for the user.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,46,Q_RADIUS_DELEGATED_IPV6_PREFIX,delegated_ipv6_prefix,,buffer,Provides the ipv6 prefix to be delegated to the user.,0,session_prt,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,29,Q_RADIUS_AVP,avp,,parent,An attribute-value pair. One or several avp_ attributes (e.g. avp_str) are created according to the avp_type.,0,session_mod,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,30,Q_RADIUS_AVP_TYPE,avp_type,,uint8,Attribute type.,0,session_mod,0
158,Q_PROTO_RADIUS,Authentication,radius,Remote Authentication Dial-In User Service,31,Q_RADIUS_AVP_TAG,avp_tag,,uint8,The tag value depends on the tunnel used. (CLEP_DATA_UINT8),0,session_mod,0
Expand Down Expand Up @@ -3341,6 +3345,7 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
201,Q_PROTO_STUN,Network Service,stun,Session Traversal Utilities for NAT,5,Q_STUN_XOR_MAPPED_ADDRESS_IPV4,xor_mapped_address_ipv4,,ip_addr,IP v4 address to be mapped (deobfuscated version).,0,session_mod,0
201,Q_PROTO_STUN,Network Service,stun,Session Traversal Utilities for NAT,6,Q_STUN_XOR_MAPPED_ADDRESS_IPV6,xor_mapped_address_ipv6,,ip6_addr,IP v6 address to be mapped (deobfuscated version).,0,session_mod,0
201,Q_PROTO_STUN,Network Service,stun,Session Traversal Utilities for NAT,7,Q_STUN_XOR_PORT,xor_port,,uint16,port to be mapped (deobfuscated version).,0,session_mod,0
201,Q_PROTO_STUN,Network Service,stun,Session Traversal Utilities for NAT,8,Q_STUN_MAGIC_COOKIE,magic_cookie,,uint32,The magic cookie used to deobfuscate the XOR port and XOR mapped address,0,session_mod,0
204,Q_PROTO_SYSLOG,Application Service,syslog,Syslog,3,Q_SYSLOG_SYSLOG_MESSAGE,syslog_message,,string,Message.,0,session_mod,0
204,Q_PROTO_SYSLOG,Application Service,syslog,Syslog,1,Q_SYSLOG_CODE,code,,string,Message type.,0,session_mod,0
525,Q_PROTO_T38,Network Service,t38,T.38,617,Q_MPA_END,end,,ptr,Indicates the end of a top level event.,0,session_mod,0
Expand Down Expand Up @@ -3948,6 +3953,7 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
237,Q_PROTO_YMSG,Instant Messaging,ymsg,Yahoo Messenger,521,Q_MPA_CALL_DURATION,call_duration,,timeval,Call duration.,0,session_fix,0
237,Q_PROTO_YMSG,Instant Messaging,ymsg,Yahoo Messenger,15,Q_YMSG_TRANSFER_ID,transfer_id,,string,Transfer identifier.,0,session_fix,0
237,Q_PROTO_YMSG,Instant Messaging,ymsg,Yahoo Messenger,16,Q_YMSG_WEBCAM_BRAND,webcam_brand,,string,Webcam brand.,0,session_fix,0
237,Q_PROTO_YMSG,Instant Messaging,ymsg,Yahoo Messenger,17,Q_YMSG_CONFERENCE_ID,conference_id,,string,room identifier for a given conference,0,session_mod,0
238,Q_PROTO_YMSG_CONF,Instant Messaging,ymsg_conf,Yahoo Messenger conference service,545,Q_MPA_INHERIT_KEY,inherit_key,,binary,"Candidate inheritance key, generated from the first ixE-classified child session packet.",0,session_mod,0
238,Q_PROTO_YMSG_CONF,Instant Messaging,ymsg_conf,Yahoo Messenger conference service,546,Q_MPA_INHERIT_PARENT,inherit_parent,,binary,"Parent inheritance key, stored in an hashtable and kept until parent session expiration.",0,session_mod,0
238,Q_PROTO_YMSG_CONF,Instant Messaging,ymsg_conf,Yahoo Messenger conference service,550,Q_MPA_LOGIN,login,,string,User's login string.,0,session_mod,0
Expand Down Expand Up @@ -4015,6 +4021,8 @@ protocol id,proto_idname,proto_family,proto_name,proto_longname,attr_id,attr_id_
240,Q_PROTO_YOUTUBE,Web,youtube,Youtube.com,709,Q_MPA_START_TIME,start_time,,uint32,Start date of the call.,0,session_prt,0
240,Q_PROTO_YOUTUBE,Web,youtube,Youtube.com,769,Q_MPA_VIDEO_TOTALDURATION,video_totalduration,,uint32,Total duration of the video in seconds (not extracted).,0,session_prt,0
240,Q_PROTO_YOUTUBE,Web,youtube,Youtube.com,770,Q_MPA_TOTAL_DATARATE,total_datarate,,uint32,Sum of video and audio datarates.,0,session_prt,0
240,Q_PROTO_YOUTUBE,Web,youtube,Youtube.com,784,Q_MPA_VIDEO_TYPE,video_type,,string,File format.,0,session_mod,0
240,Q_PROTO_YOUTUBE,Web,youtube,Youtube.com,772,Q_MPA_VIDEO_AVGDATARATE,video_avgdatarate,,uint32,Average video bitrate in kilobits per second.,0,session_mod,0
311,Q_PROTO_ZIMBRA,Webmail,zimbra,Zimbra.com,617,Q_MPA_END,end,,ptr,Indicates the end of a top level event.,0,session_mod,0
311,Q_PROTO_ZIMBRA,Webmail,zimbra,Zimbra.com,550,Q_MPA_LOGIN,login,,string,User's login string.,0,session_fix,0
311,Q_PROTO_ZIMBRA,Webmail,zimbra,Zimbra.com,578,Q_MPA_PASSWORD,password,,string,User's password string.,0,session_fix,0
Expand Down
Loading

0 comments on commit e391432

Please sign in to comment.