From 1078d5643010a24a45766fc5fd2b169649963875 Mon Sep 17 00:00:00 2001 From: snicket2100 <57048005+snicket2100@users.noreply.github.com> Date: Fri, 28 Jul 2023 16:06:51 +0200 Subject: [PATCH] Mullvad VPN service added (based on entry node IP addresses) --- doc/protocols.rst | 11 + src/include/ndpi_protocol_ids.h | 1 + src/include/ndpi_typedefs.h | 1 + .../inc_generated/ndpi_mullvad_match.c.inc | 677 ++++++++++++++++++ src/lib/ndpi_content_match.c.inc | 2 + src/lib/ndpi_main.c | 10 +- tests/cfgs/default/pcap/mullvad_dns.pcap | Bin 0 -> 270 bytes .../cfgs/default/pcap/mullvad_wireguard.pcap | Bin 0 -> 2108 bytes ...om_rules_same-ip_multiple_ports.pcapng.out | 6 +- .../cfgs/default/result/mullvad_dns.pcap.out | 25 + .../default/result/mullvad_wireguard.pcap.out | 25 + tests/cfgs/default/result/srvloc.pcap.out | 4 +- tests/cfgs/default/result/synscan.pcap.out | 4 +- utils/mullvad_ip_addresses_download.sh | 28 + utils/update_every_lists.sh | 2 + 15 files changed, 788 insertions(+), 8 deletions(-) create mode 100644 src/lib/inc_generated/ndpi_mullvad_match.c.inc create mode 100644 tests/cfgs/default/pcap/mullvad_dns.pcap create mode 100644 tests/cfgs/default/pcap/mullvad_wireguard.pcap create mode 100644 tests/cfgs/default/result/mullvad_dns.pcap.out create mode 100644 tests/cfgs/default/result/mullvad_wireguard.pcap.out create mode 100755 utils/mullvad_ip_addresses_download.sh diff --git a/doc/protocols.rst b/doc/protocols.rst index 44cc3e2d52e..a5f3ce3f6cf 100644 --- a/doc/protocols.rst +++ b/doc/protocols.rst @@ -99,3 +99,14 @@ Notes: The Service Location Protocol is a service discovery protocol that allows computers and other devices to find services in a local area network without prior configuration. References: `SLPv1 `_ `SLPv2 `_. + + +.. _Proto 348: + +`NDPI_PROTOCOL_MULLVAD` +======================== +Mullvad is a VPN service operated by Mullvad VPN AB, based in Sweden + +References: `Main site https://mullvad.net/` + + diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h index 69e95745275..dda9b7acd8e 100644 --- a/src/include/ndpi_protocol_ids.h +++ b/src/include/ndpi_protocol_ids.h @@ -376,6 +376,7 @@ typedef enum { NDPI_PROTOCOL_APACHE_THRIFT = 345, NDPI_PROTOCOL_ROBLOX = 346, NDPI_PROTOCOL_SERVICE_LOCATION = 347, + NDPI_PROTOCOL_MULLVAD = 348, #ifdef CUSTOM_NDPI_PROTOCOLS #include "../../../nDPI-custom/custom_ndpi_protocol_ids.h" diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h index 708322a5dab..18d2bc0785f 100644 --- a/src/include/ndpi_typedefs.h +++ b/src/include/ndpi_typedefs.h @@ -1768,6 +1768,7 @@ typedef enum { See: https://www.usenix.org/system/files/sec23fall-prepub-234-wu-mingshi.pdf */ ndpi_disable_fully_encrypted_heuristic = (1 << 21), ndpi_dont_load_protonvpn_exit_nodes_list = (1 << 22), + ndpi_dont_load_mullvad_list = (1 << 23), } ndpi_prefs; typedef struct { diff --git a/src/lib/inc_generated/ndpi_mullvad_match.c.inc b/src/lib/inc_generated/ndpi_mullvad_match.c.inc new file mode 100644 index 00000000000..b1da2bc9f40 --- /dev/null +++ b/src/lib/inc_generated/ndpi_mullvad_match.c.inc @@ -0,0 +1,677 @@ +/* + * + * This file is generated automatically and part of nDPI + * + * nDPI is free software: you can redistribute it and/or modify + * it under the terms of the GNU Lesser General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * nDPI is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with nDPI. If not, see . + * + */ + +/* ****************************************************** */ + + +static ndpi_network ndpi_protocol_mullvad_protocol_list[] = { + { 0x2D09F922 /* 45.9.249.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x1FAB9A32 /* 31.171.154.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x1FAB9942 /* 31.171.153.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924674C2 /* 146.70.116.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924674E2 /* 146.70.116.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467462 /* 146.70.116.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467482 /* 146.70.116.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924674A2 /* 146.70.116.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D61492 /* 103.214.20.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D614A2 /* 103.214.20.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D61432 /* 103.214.20.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D61482 /* 103.214.20.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D8DC32 /* 103.216.220.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D8DC42 /* 103.216.220.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D8DC12 /* 103.216.220.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x67D8DC22 /* 103.216.220.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE552 /* 103.108.229.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE562 /* 103.108.229.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE532 /* 103.108.229.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE542 /* 103.108.229.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE752 /* 103.108.231.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE762 /* 103.108.231.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE732 /* 103.108.231.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x676CE742 /* 103.108.231.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468D9A /* 146.70.141.154/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C882 /* 146.70.200.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C842 /* 146.70.200.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C802 /* 146.70.200.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468DC2 /* 146.70.141.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C8C2 /* 146.70.200.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2578DAAA /* 37.120.218.170/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x52661342 /* 82.102.19.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5BCF3982 /* 91.207.57.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A7B02 /* 91.90.123.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC26E7322 /* 194.110.115.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC26E7302 /* 194.110.115.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BC42 /* 146.70.188.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BC02 /* 146.70.188.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BC82 /* 146.70.188.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BCC2 /* 146.70.188.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x954EB8D2 /* 149.78.184.210/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x954EB8C2 /* 149.78.184.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C642 /* 169.150.198.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C64F /* 169.150.198.79/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xD98AD512 /* 217.138.213.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2578ED42 /* 37.120.237.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D85B6C2 /* 45.133.182.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C642 /* 146.70.198.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C682 /* 146.70.198.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C6C2 /* 146.70.198.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xBCF1B0C2 /* 188.241.176.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8CE2 /* 198.44.140.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D6C1 /* 178.249.214.193/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D6CE /* 178.249.214.206/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368422 /* 198.54.132.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368442 /* 198.54.132.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D602 /* 178.249.214.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D60F /* 178.249.214.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8C82 /* 198.44.140.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368462 /* 198.54.132.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC63684E2 /* 198.54.132.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368482 /* 198.54.132.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8CA2 /* 198.44.140.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC63684A2 /* 198.54.132.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8CC2 /* 198.44.140.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x26F0E264 /* 38.240.226.100/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x26F0E284 /* 38.240.226.132/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x26F0E224 /* 38.240.226.36/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x26F0E244 /* 38.240.226.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x26F0E124 /* 38.240.225.36/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x26F0E144 /* 38.240.225.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F75 /* 193.32.127.117/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5BC104D2 /* 91.193.4.210/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F51 /* 193.32.127.81/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F52 /* 193.32.127.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F53 /* 193.32.127.83/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F54 /* 193.32.127.84/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x51111042 /* 81.17.16.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468682 /* 146.70.134.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924686A2 /* 146.70.134.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F42 /* 193.32.127.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F43 /* 193.32.127.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F44 /* 193.32.127.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F45 /* 193.32.127.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207F46 /* 193.32.127.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB32BBD42 /* 179.43.189.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2E1388E2 /* 46.19.136.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC706C2 /* 138.199.6.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC706CF /* 138.199.6.207/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC706DC /* 138.199.6.220/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC706E9 /* 138.199.6.233/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468662 /* 146.70.134.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467EA2 /* 146.70.126.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467EC2 /* 146.70.126.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467EE2 /* 146.70.126.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468602 /* 146.70.134.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468622 /* 146.70.134.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468642 /* 146.70.134.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9A2F1022 /* 154.47.16.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9A2F102F /* 154.47.16.47/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xD98AC76A /* 217.138.199.106/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924681A2 /* 146.70.129.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924681C2 /* 146.70.129.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468162 /* 146.70.129.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468182 /* 146.70.129.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D1A2 /* 178.249.209.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D1AF /* 178.249.209.175/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F848 /* 193.32.248.72/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F849 /* 193.32.248.73/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F84A /* 193.32.248.74/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F84B /* 193.32.248.75/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F842 /* 193.32.248.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F843 /* 193.32.248.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F844 /* 193.32.248.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F845 /* 193.32.248.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F846 /* 193.32.248.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F847 /* 193.32.248.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9FE4B03 /* 185.254.75.3/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9FE4B04 /* 185.254.75.4/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9FE4B05 /* 185.254.75.5/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B75 /* 185.213.155.117/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B42 /* 185.213.155.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B43 /* 185.213.155.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B44 /* 185.213.155.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B45 /* 185.213.155.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B46 /* 185.213.155.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B47 /* 185.213.155.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B48 /* 185.213.155.72/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467542 /* 146.70.117.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467562 /* 146.70.117.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B49 /* 185.213.155.73/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59B4A /* 185.213.155.74/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D1C449 /* 185.209.196.73/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D1C44A /* 185.209.196.74/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D1C44B /* 185.209.196.75/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D1C44C /* 185.209.196.76/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D1C44D /* 185.209.196.77/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D1C44E /* 185.209.196.78/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924675A2 /* 146.70.117.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924675C2 /* 146.70.117.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924675E2 /* 146.70.117.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92466BC2 /* 146.70.107.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467502 /* 146.70.117.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467522 /* 146.70.117.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC2241903 /* 194.36.25.3/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC2241912 /* 194.36.25.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC2241921 /* 194.36.25.33/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC2241930 /* 194.36.25.48/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C902 /* 169.150.201.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C90F /* 169.150.201.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C91C /* 169.150.201.28/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FE47 /* 141.98.254.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D813851 /* 45.129.56.81/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C542 /* 146.70.197.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C502 /* 146.70.197.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D813843 /* 45.129.56.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D813844 /* 45.129.56.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x52678CD5 /* 82.103.140.213/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C5C2 /* 146.70.197.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C582 /* 146.70.197.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FA743 /* 194.127.167.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FA757 /* 194.127.167.87/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FA76B /* 194.127.167.107/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924680A2 /* 146.70.128.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92464A62 /* 146.70.74.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D86D5C2 /* 45.134.213.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D86D5CF /* 45.134.213.207/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924680C2 /* 146.70.128.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924680E2 /* 146.70.128.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18A0784 /* 193.138.7.132/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01AB /* 185.204.1.171/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01AC /* 185.204.1.172/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01AD /* 185.204.1.173/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01AE /* 185.204.1.174/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01AF /* 185.204.1.175/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01B0 /* 185.204.1.176/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D495C9 /* 185.212.149.201/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18A07D9 /* 193.138.7.217/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18A07ED /* 193.138.7.237/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01CB /* 185.204.1.203/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01D3 /* 185.204.1.211/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9CC01DB /* 185.204.1.219/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18A0789 /* 193.138.7.137/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18A079D /* 193.138.7.157/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18A07B1 /* 193.138.7.177/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18A07C5 /* 193.138.7.197/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC70FA2 /* 138.199.15.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC70F92 /* 138.199.15.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E75 /* 193.32.126.117/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E51 /* 193.32.126.81/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E52 /* 193.32.126.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E53 /* 193.32.126.83/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E54 /* 193.32.126.84/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B882 /* 146.70.184.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B8C2 /* 146.70.184.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E42 /* 193.32.126.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E43 /* 193.32.126.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E44 /* 193.32.126.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E45 /* 193.32.126.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC1207E46 /* 193.32.126.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B802 /* 146.70.184.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B842 /* 146.70.184.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FC42 /* 141.98.252.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FC83 /* 141.98.252.131/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FC84 /* 141.98.252.132/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FC85 /* 141.98.252.133/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E855 /* 185.195.232.85/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E856 /* 185.195.232.86/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FC8A /* 141.98.252.138/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467762 /* 146.70.119.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467782 /* 146.70.119.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924677A2 /* 146.70.119.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FC82 /* 141.98.252.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FCDE /* 141.98.252.222/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E842 /* 185.195.232.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E843 /* 185.195.232.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E844 /* 185.195.232.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E845 /* 185.195.232.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E846 /* 185.195.232.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9F85503 /* 185.248.85.3/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9F85512 /* 185.248.85.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9F85521 /* 185.248.85.33/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9F85530 /* 185.248.85.48/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467742 /* 146.70.119.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467702 /* 146.70.119.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467722 /* 146.70.119.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x59EE863A /* 89.238.134.58/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468402 /* 146.70.132.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468422 /* 146.70.132.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468442 /* 146.70.132.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468462 /* 146.70.132.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468562 /* 146.70.133.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468482 /* 146.70.132.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924684A2 /* 146.70.132.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924684C2 /* 146.70.132.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x924684E2 /* 146.70.132.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468502 /* 146.70.133.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468522 /* 146.70.133.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468542 /* 146.70.133.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9566F61C /* 149.102.246.28/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9566F629 /* 149.102.246.41/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9566F602 /* 149.102.246.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9566F60F /* 149.102.246.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xD13AB93B /* 209.58.185.59/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x592D0632 /* 89.45.6.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x677DE921 /* 103.125.233.33/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x677DE930 /* 103.125.233.48/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x592D0652 /* 89.45.6.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x592D0662 /* 89.45.6.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x592D0672 /* 89.45.6.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x677DE912 /* 103.125.233.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x677DE903 /* 103.125.233.3/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9A2F1D02 /* 154.47.29.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9A2F1D0F /* 154.47.29.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C442 /* 146.70.196.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C402 /* 146.70.196.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C4C2 /* 146.70.196.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C482 /* 146.70.196.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BD82 /* 146.70.189.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BDC2 /* 146.70.189.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BD02 /* 146.70.189.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BD42 /* 146.70.189.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996E3C5 /* 169.150.227.197/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996E3D2 /* 169.150.227.210/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996E3DE /* 169.150.227.222/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5928B692 /* 89.40.182.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC0917F62 /* 192.145.127.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC0917F72 /* 192.145.127.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5928B6D2 /* 89.40.182.210/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D342 /* 178.249.211.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D34F /* 178.249.211.79/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2F9D35C /* 178.249.211.92/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5BC10512 /* 91.193.5.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5BC10502 /* 91.193.5.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5BC10522 /* 91.193.5.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2578C972 /* 37.120.201.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2578C952 /* 37.120.201.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9859AA70 /* 152.89.170.112/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9859AA80 /* 152.89.170.128/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D08DFC3 /* 45.8.223.195/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D08DFD2 /* 45.8.223.210/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D08DFE1 /* 45.8.223.225/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D08DFF0 /* 45.8.223.240/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9F20422 /* 185.242.4.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C982 /* 146.70.201.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C9C2 /* 146.70.201.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC715EF /* 138.199.21.239/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC715E2 /* 138.199.21.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92468AC2 /* 146.70.138.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C902 /* 146.70.201.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C942 /* 146.70.201.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5CDF59A0 /* 92.223.89.160/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5CDF59B6 /* 92.223.89.182/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5CDF59B5 /* 92.223.89.181/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5CDF59A5 /* 92.223.89.165/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x1FAA1602 /* 31.170.22.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x1FAA160F /* 31.170.22.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2AF8EC2 /* 178.175.142.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB2AF8362 /* 178.175.131.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9E11C92 /* 185.225.28.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418674 /* 185.65.134.116/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418647 /* 185.65.134.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418648 /* 185.65.134.72/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418649 /* 185.65.134.73/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB941864A /* 185.65.134.74/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB941864B /* 185.65.134.75/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB941864C /* 185.65.134.76/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F942 /* 193.32.249.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418652 /* 185.65.134.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418653 /* 185.65.134.83/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F945 /* 193.32.249.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC120F946 /* 193.32.249.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418656 /* 185.65.134.86/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5C3C28C2 /* 92.60.40.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5C3C28D1 /* 92.60.40.209/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5C3C28E0 /* 92.60.40.224/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5C3C28EF /* 92.60.40.239/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C402 /* 169.150.196.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C40F /* 169.150.196.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996C41C /* 169.150.196.28/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C0A /* 91.90.44.10/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C0B /* 91.90.44.11/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C0C /* 91.90.44.12/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C0D /* 91.90.44.13/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C0E /* 91.90.44.14/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C0F /* 91.90.44.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C10 /* 91.90.44.16/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C11 /* 91.90.44.17/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5B5A2C12 /* 91.90.44.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB07DEB47 /* 176.125.235.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB07DEB48 /* 176.125.235.72/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB07DEB49 /* 176.125.235.73/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB07DEB4A /* 176.125.235.74/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FC7F5 /* 194.127.199.245/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FC772 /* 194.127.199.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FC791 /* 194.127.199.145/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FC702 /* 194.127.199.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FC71F /* 194.127.199.31/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FC73E /* 194.127.199.62/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC27FC75D /* 194.127.199.93/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x674B0B52 /* 103.75.11.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x674B0B62 /* 103.75.11.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x674B0B32 /* 103.75.11.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x674B0B42 /* 103.75.11.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x05FDCEC2 /* 5.253.206.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92469042 /* 146.70.144.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92469062 /* 146.70.144.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D86D442 /* 45.134.212.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D86D44F /* 45.134.212.79/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D86D45C /* 45.134.212.92/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D8026E2 /* 45.128.38.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92469022 /* 146.70.144.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5E2E1821 /* 94.46.24.33/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x5E2E1831 /* 94.46.24.49/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467CA2 /* 146.70.124.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2578F682 /* 37.120.246.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467C82 /* 146.70.124.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x92467CC2 /* 146.70.124.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C1C2 /* 146.70.193.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C182 /* 146.70.193.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C102 /* 146.70.193.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C142 /* 146.70.193.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A75 /* 185.213.154.117/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A83 /* 185.213.154.131/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A84 /* 185.213.154.132/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A85 /* 185.213.154.133/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A86 /* 185.213.154.134/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A87 /* 185.213.154.135/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A88 /* 185.213.154.136/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A89 /* 185.213.154.137/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A8A /* 185.213.154.138/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A8B /* 185.213.154.139/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A8C /* 185.213.154.140/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A8D /* 185.213.154.141/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A42 /* 185.213.154.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A43 /* 185.213.154.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A44 /* 185.213.154.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A45 /* 185.213.154.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9D59A46 /* 185.213.154.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADA47 /* 193.138.218.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D53DC75 /* 45.83.220.117/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADA83 /* 193.138.218.131/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADA84 /* 193.138.218.132/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF53 /* 141.98.255.83/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF54 /* 141.98.255.84/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF55 /* 141.98.255.85/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF56 /* 141.98.255.86/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF57 /* 141.98.255.87/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF58 /* 141.98.255.88/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF59 /* 141.98.255.89/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF5A /* 141.98.255.90/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF5B /* 141.98.255.91/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF5C /* 141.98.255.92/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8D62FF5D /* 141.98.255.93/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D53DC5C /* 45.83.220.92/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADADC /* 193.138.218.220/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADA50 /* 193.138.218.80/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADA53 /* 193.138.218.83/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADA82 /* 193.138.218.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC18ADA52 /* 193.138.218.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D53DC44 /* 45.83.220.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D53DC45 /* 45.83.220.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D53DC46 /* 45.83.220.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418750 /* 185.65.135.80/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418751 /* 185.65.135.81/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418752 /* 185.65.135.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418753 /* 185.65.135.83/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E94C /* 185.195.233.76/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418743 /* 185.65.135.67/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418744 /* 185.65.135.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418745 /* 185.65.135.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418748 /* 185.65.135.72/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418749 /* 185.65.135.73/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418746 /* 185.65.135.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9418747 /* 185.65.135.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E945 /* 185.195.233.69/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E946 /* 185.195.233.70/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E947 /* 185.195.233.71/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E942 /* 185.195.233.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB9C3E944 /* 185.195.233.68/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C022 /* 146.70.192.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C742 /* 146.70.199.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C702 /* 146.70.199.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC73C02 /* 138.199.60.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC73C0F /* 138.199.60.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC73C1C /* 138.199.60.28/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C7C2 /* 146.70.199.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246C782 /* 146.70.199.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC72281 /* 138.199.34.129/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC7228F /* 138.199.34.143/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9566F04F /* 149.102.240.79/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9566F042 /* 149.102.240.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4F1 /* 66.115.180.241/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D868C9C /* 45.134.140.156/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D868CA9 /* 45.134.140.169/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E2 /* 66.115.180.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E3 /* 66.115.180.227/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E4 /* 66.115.180.228/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E5 /* 66.115.180.229/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E6 /* 66.115.180.230/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D868C82 /* 45.134.140.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D868C8F /* 45.134.140.143/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E7 /* 66.115.180.231/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E8 /* 66.115.180.232/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4E9 /* 66.115.180.233/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4EA /* 66.115.180.234/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4EB /* 66.115.180.235/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4EC /* 66.115.180.236/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4ED /* 66.115.180.237/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4EE /* 66.115.180.238/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273B4F0 /* 66.115.180.240/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x6B961602 /* 107.150.22.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x68811862 /* 104.129.24.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x68811872 /* 104.129.24.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x68DF5B12 /* 104.223.91.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2C82 /* 68.235.44.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2B22 /* 68.235.43.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2B42 /* 68.235.43.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2B62 /* 68.235.43.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2C02 /* 68.235.44.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2B82 /* 68.235.43.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2C22 /* 68.235.44.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2BA2 /* 68.235.43.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2C42 /* 68.235.44.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x44EB2C62 /* 68.235.44.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x423FA772 /* 66.63.167.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x423FA7C2 /* 66.63.167.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x423FA792 /* 66.63.167.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x57F98601 /* 87.249.134.1/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x57F9860E /* 87.249.134.14/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x57F9861B /* 87.249.134.27/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7112 /* 174.127.113.18/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246D3C2 /* 146.70.211.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B142 /* 146.70.177.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7103 /* 174.127.113.3/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7104 /* 174.127.113.4/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7105 /* 174.127.113.5/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7106 /* 174.127.113.6/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7107 /* 174.127.113.7/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246D342 /* 146.70.211.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246D302 /* 146.70.211.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246D382 /* 146.70.211.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7108 /* 174.127.113.8/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7109 /* 174.127.113.9/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F710A /* 174.127.113.10/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F710B /* 174.127.113.11/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F710C /* 174.127.113.12/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F710D /* 174.127.113.13/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F710E /* 174.127.113.14/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F710F /* 174.127.113.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7110 /* 174.127.113.16/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAE7F7111 /* 174.127.113.17/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x602CBF82 /* 96.44.191.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x602CBF92 /* 96.44.191.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x602CBD62 /* 96.44.189.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513C89C /* 37.19.200.156/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513C88F /* 37.19.200.143/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513C882 /* 37.19.200.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8062 /* 198.44.128.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C80E2 /* 198.44.128.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C80C2 /* 198.44.128.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C80A2 /* 198.44.128.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8082 /* 198.44.128.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513D201 /* 37.19.210.1/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513D20E /* 37.19.210.14/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513D21B /* 37.19.210.27/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513DD82 /* 37.19.221.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513DD8F /* 37.19.221.143/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513DD9C /* 37.19.221.156/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2513DDA9 /* 37.19.221.169/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x3E852CCA /* 62.133.44.202/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C81A2 /* 198.44.129.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8182 /* 198.44.129.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996CB29 /* 169.150.203.41/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996CB36 /* 169.150.203.54/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AC42 /* 146.70.172.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AC82 /* 146.70.172.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246ACC2 /* 146.70.172.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AE02 /* 146.70.174.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8162 /* 198.44.129.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8142 /* 198.44.129.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8122 /* 198.44.129.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996CB02 /* 169.150.203.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996CB0F /* 169.150.203.15/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xA996CB1C /* 169.150.203.28/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC66059C2 /* 198.96.89.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xCC98D862 /* 204.152.216.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xCC98D872 /* 204.152.216.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AD02 /* 146.70.173.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AD42 /* 146.70.173.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AD82 /* 146.70.173.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246ADC2 /* 146.70.173.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AC02 /* 146.70.172.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B722 /* 146.70.183.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BBC2 /* 146.70.187.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B742 /* 146.70.183.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D868EDB /* 45.134.142.219/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D868ECE /* 45.134.142.206/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x2D868EC1 /* 45.134.142.193/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BB02 /* 146.70.187.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BB42 /* 146.70.187.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246BB82 /* 146.70.187.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xAD2C3F42 /* 173.44.63.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x688129C2 /* 104.129.41.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xD46730E2 /* 212.103.48.226/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x26847992 /* 38.132.121.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8882 /* 198.44.136.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C88A2 /* 198.44.136.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C88C2 /* 198.44.136.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A802 /* 146.70.168.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A602 /* 146.70.166.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A642 /* 146.70.166.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A542 /* 146.70.165.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246ABC2 /* 146.70.171.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B982 /* 146.70.185.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B942 /* 146.70.185.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A8C2 /* 146.70.168.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8FF42F41 /* 143.244.47.65/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8FF42F4E /* 143.244.47.78/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8FF42F5B /* 143.244.47.91/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8822 /* 198.44.136.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8842 /* 198.44.136.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC62C8862 /* 198.44.136.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A502 /* 146.70.165.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A582 /* 146.70.165.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A5C2 /* 146.70.165.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A682 /* 146.70.166.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A6C2 /* 146.70.166.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246B902 /* 146.70.185.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A882 /* 146.70.168.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246A842 /* 146.70.168.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AB42 /* 146.70.171.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9246AB82 /* 146.70.171.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368522 /* 198.54.133.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368542 /* 198.54.133.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368562 /* 198.54.133.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368582 /* 198.54.133.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC63685A2 /* 198.54.133.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC63687A2 /* 198.54.135.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC63687C2 /* 198.54.135.194/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB99C2EA9 /* 185.156.46.169/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB99C2EB6 /* 185.156.46.182/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368722 /* 198.54.135.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368742 /* 198.54.135.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368762 /* 198.54.135.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368782 /* 198.54.135.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB99C2E8F /* 185.156.46.143/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xB99C2E9C /* 185.156.46.156/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC63682B2 /* 198.54.130.178/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368222 /* 198.54.130.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368232 /* 198.54.130.50/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368242 /* 198.54.130.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368252 /* 198.54.130.82/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368262 /* 198.54.130.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368272 /* 198.54.130.114/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368282 /* 198.54.130.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368292 /* 198.54.130.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368322 /* 198.54.131.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368342 /* 198.54.131.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC72B5B /* 138.199.43.91/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC72B4E /* 138.199.43.78/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8AC72B41 /* 138.199.43.65/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368382 /* 198.54.131.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368362 /* 198.54.131.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA34 /* 199.229.250.52/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA35 /* 199.229.250.53/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA36 /* 199.229.250.54/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA37 /* 199.229.250.55/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA38 /* 199.229.250.56/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA39 /* 199.229.250.57/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA3A /* 199.229.250.58/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC7E5FA3B /* 199.229.250.59/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x68813942 /* 104.129.57.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xADCD5D02 /* 173.205.93.2/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368622 /* 198.54.134.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368642 /* 198.54.134.66/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368662 /* 198.54.134.98/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC6368682 /* 198.54.134.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xC63686A2 /* 198.54.134.162/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5D3 /* 66.115.165.211/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5D4 /* 66.115.165.212/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5D5 /* 66.115.165.213/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5D6 /* 66.115.165.214/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5D7 /* 66.115.165.215/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5D8 /* 66.115.165.216/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5D9 /* 66.115.165.217/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4273A5DA /* 66.115.165.218/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8E9359C3 /* 142.147.89.195/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8E9359D2 /* 142.147.89.210/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x8E9359E1 /* 142.147.89.225/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA92 /* 69.4.234.146/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA84 /* 69.4.234.132/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA85 /* 69.4.234.133/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA86 /* 69.4.234.134/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA87 /* 69.4.234.135/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA88 /* 69.4.234.136/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA89 /* 69.4.234.137/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA93 /* 69.4.234.147/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA8A /* 69.4.234.138/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA8B /* 69.4.234.139/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA8C /* 69.4.234.140/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA8D /* 69.4.234.141/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA8E /* 69.4.234.142/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA8F /* 69.4.234.143/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA90 /* 69.4.234.144/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x4504EA91 /* 69.4.234.145/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xD1366582 /* 209.54.101.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x68DF7622 /* 104.223.118.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0xADCD5522 /* 173.205.85.34/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9A2F1E82 /* 154.47.30.130/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + { 0x9A2F1E8F /* 154.47.30.143/32 */, 32, NDPI_PROTOCOL_MULLVAD }, + /* End */ + { 0x0, 0, 0 } +}; diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc index 3b7a9d170a1..9bb40ae7ce6 100644 --- a/src/lib/ndpi_content_match.c.inc +++ b/src/lib/ndpi_content_match.c.inc @@ -1400,6 +1400,8 @@ static ndpi_protocol_match host_match[] = { "roblox.com", "Roblox", NDPI_PROTOCOL_ROBLOX, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, { "rbxcdn.com", "Roblox", NDPI_PROTOCOL_ROBLOX, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN, NDPI_PROTOCOL_DEFAULT_LEVEL }, + { "mullvad.net", "Mullvad", NDPI_PROTOCOL_MULLVAD, NDPI_PROTOCOL_CATEGORY_VPN, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_DEFAULT_LEVEL }, + /* ADS/tracking/analytic */ diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c index 9d31564a708..d806957ed0a 100644 --- a/src/lib/ndpi_main.c +++ b/src/lib/ndpi_main.c @@ -78,6 +78,7 @@ #include "inc_generated/ndpi_icloud_private_relay_match.c.inc" #include "inc_generated/ndpi_protonvpn_in_match.c.inc" #include "inc_generated/ndpi_protonvpn_out_match.c.inc" +#include "inc_generated/ndpi_mullvad_match.c.inc" #include "inc_generated/ndpi_asn_telegram.c.inc" #include "inc_generated/ndpi_asn_apple.c.inc" #include "inc_generated/ndpi_asn_twitter.c.inc" @@ -1303,7 +1304,7 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Reddit", NDPI_PROTOCOL_CATEGORY_SOCIAL_NETWORK, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); - ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WIREGUARD, + ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 0 /* nw proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_WIREGUARD, "WireGuard", NDPI_PROTOCOL_CATEGORY_VPN, ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 51820, 0, 0, 0, 0) /* UDP */); @@ -2151,6 +2152,10 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp "Service_Location_Protocol", NDPI_PROTOCOL_CATEGORY_RPC, ndpi_build_default_ports(ports_a, 427, 0, 0, 0, 0) /* TCP */, ndpi_build_default_ports(ports_b, 427, 0, 0, 0, 0) /* UDP */); + ndpi_set_proto_defaults(ndpi_str, 0 /* encrypted */, 1 /* app proto */, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_MULLVAD, + "Mullvad", NDPI_PROTOCOL_CATEGORY_VPN, + ndpi_build_default_ports(ports_a, 0, 0, 0, 0, 0) /* TCP */, + ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0) /* UDP */); #ifdef CUSTOM_NDPI_PROTOCOLS @@ -2883,6 +2888,9 @@ struct ndpi_detection_module_struct *ndpi_init_detection_module(ndpi_init_prefs if(!(prefs & ndpi_dont_load_protonvpn_list)) ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_protonvpn_protocol_list); + if(!(prefs & ndpi_dont_load_mullvad_list)) + ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_mullvad_protocol_list); + if(!(prefs & ndpi_dont_load_asn_lists)) { ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_telegram_protocol_list); ndpi_init_ptree_ipv4(ndpi_str, ndpi_str->protocols_ptree, ndpi_protocol_apple_protocol_list); diff --git a/tests/cfgs/default/pcap/mullvad_dns.pcap b/tests/cfgs/default/pcap/mullvad_dns.pcap new file mode 100644 index 0000000000000000000000000000000000000000..4c98dda48b883471526da783b2e264e154987311 GIT binary patch literal 270 zcmca|c+)~A1{MYcU}0bcasrA^rR02IV@LwBL0E6%x(mXqgO=TQ%Ie@?aAjZ!`B2Ef zU@vHwbYMjlHzyFB{J>z!;NUAB*~X{+ zG?IaVhk=WM6qRJKA$K?qX3fJ})LXk>^q3Ri}j zQY95h3`1oISki!iY%o!fbw#En3dj(+ITXBFpZ0y8_c`bM^FE*R{r%owcYO&10ziTP zFDM`;`ap&?`K3{$fE3X?xV17_?Q%uVw+E~OX%c`90L1ps0)U0gPFx)`dOOeH2VYlf zIW7>8$OF$(h`>k5iJssxZ6sc8RAL#eIQzdChU17VM9zA8>GgrS?a#as&b_UwVbLarJa1o0H)v6sj_Z4eVB3bVrkdLxI zO@I1CG6^6SW(xoZWMI9Z3e?GQU9EwD)MQY0?})StV%-G*+a(BjQ+>}1R!TX7Brx2+*ZobfT8Ld}c;N8P z>uhi6{?L79&nG(bYCsuI2mzu+=Y#u;%qTBq)-%I?mYHkf{msneH)OSvX^i9MRT&d` zB|(nQu6&3q8SQ(bSwLY^2q9^1ZMUCx0DC%8;wCMjjg`%V z9R(%dh$Ky-^T7Rur23^SC_#08CSfMQHzf)ilKdM69cglTGk8Oy&Q|y}X2Pyl%r!nl zXK=QgbR?w7(plD~&ndVq@t8VF*wFP3!`3*pbZ2nYnt@sM<-Pb>9A#M>vuHT@s7jd2+o?g6el$W$6)fZ!%Mt)rkt{CoRdCHI#-Ewa=3{_D;zm)U7`GB(HWw zAy*e>Z`2cOt6cpwHPcEV7yPsR3Gj~@e^Gr3?7Q{qH+)uo*CF}M>Pv6@**J>|;l`n- z%`qBIEV#=m5>X_aSj>xHEfnTvVOtdQ`_u?Ka?mx2d?+-vW*bAXbm>DpoJ`}tDZbfS zbJ!7-XzkhtG(kiei}qh7kZRZuphVpLQwfBb6R;@}HN*NkKNop&`)l_a!>z5A{P_n( z9;e^_>!KsJ8#`*CD8D@M0!0kW_82ajFi1`*OtJBBF791QQMs2nt>!oKbeU5>^x^V5 zySQr2rAKZ-)PpuvH-#Rlobd^&Q}NOrTr;upWD@=mLxuIbLs<(QIvHC$E9PM;70AA$ zv+u`W5B71iC8a&;lrNY+&=zRInsI9!)3SIH-R;G#py(VwbdrLj!2ti*?MbiB(};|Q zm69oD{1W<{d7Mjkp|RTtIl+>qxdXv<^+o!@+2n#iD!pCr$8-rvK6|IJbZOAp`o~I{ zsuTieS=l20slT2%E)gF;Z6AKA4lYIqx<&*8Wzd(I)ElJ#TtAotNA(xv%4$Z`%aW_> zjvgr}HOWXUYg>RB=Z6R_2OyA`ViJAW!!XM~k z3Ge&b{_?0*r}#-3gI1>^(Fya>Y4@AK8BQ%y8oJP3=dy@P#_hy2(xwXr?h~(xGrDJM z`zN8AX1bZp`gYxR&W#S}F;c#jb6AN4(tD=-fJ*9n{DNosWC*4GK-h6=9UvYtxa;X>b@Okxn_3}p? z(`$TdbaqH_@}7~d3SI4Q4smbAJWf;E>YqecGSarV1Q|b^FE&f@?K*l`y!}O>LH9+a zwKgeLYeRABLDR>2&5f1rB(SqRM4kN)b8K{ddJsOF9-quH7F86NVtC;JB-FHVtQA}&ppJ>?xn! zN-*UhT?YyKS9`Q}m8Vs&;YsP^4;KYytDxlk_>Pa6{Png26c}fH?!tm}Q;cjFo z{S2>pA`b}>8**7@=&j6xlCn=EU(9yOKromIvf=MC*|{MZT8Z*{9#6yvzY1=x)>xU* zKn`b)EQVns3+UH9E|S$9JFC2hcSF>np2jScJT>`=v(LFW*dIBFQ-0W>5AewU0r7Zk AKmY&$ literal 0 HcmV?d00001 diff --git a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out index c2d2e555a20..5822e4d153a 100644 --- a/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out +++ b/tests/cfgs/default/result/custom_rules_same-ip_multiple_ports.pcapng.out @@ -24,6 +24,6 @@ CustomProtocolA 3 222 1 CustomProtocolB 2 148 1 Unknown 3 222 1 - 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.354/TLS.CustomProtocolA][IP: 354/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 356/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 355/CustomProtocolB][IP: 355/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 1 TCP 192.168.1.245:56866 -> 3.3.3.3:443 [proto: 91.355/TLS.CustomProtocolA][IP: 355/CustomProtocolA][Encrypted][Confidence: Unknown][DPI packets: 1][cat: Web/5][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.05 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 2 TCP 192.168.1.245:58288 -> 3.3.3.3:446 [proto: 400/CustomProtocolC][IP: 357/Unknown][Encrypted][Confidence: Unknown][DPI packets: 1][3 pkts/222 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][3.04 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 3 TCP 192.168.1.245:59682 -> 3.3.3.3:444 [proto: 356/CustomProtocolB][IP: 356/CustomProtocolB][ClearText][Confidence: Unknown][DPI packets: 1][2 pkts/148 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][1.02 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mullvad_dns.pcap.out b/tests/cfgs/default/result/mullvad_dns.pcap.out new file mode 100644 index 00000000000..af6a597d065 --- /dev/null +++ b/tests/cfgs/default/result/mullvad_dns.pcap.out @@ -0,0 +1,25 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 2 (2.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 1 (1.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 2/2 (search/found) +Automa domain: 2/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 1/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 2/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia protocols: 2/0 (search/found) + +Mullvad 2 214 1 + + 1 UDP 192.168.122.11:51696 <-> 9.9.9.9:53 [proto: 5.348/DNS.Mullvad][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 2][cat: Network/14][1 pkts/98 bytes <-> 1 pkts/116 bytes][Goodput ratio: 57/63][0.05 sec][Hostname/SNI: www.mullvad.net][45.83.223.209][PLAIN TEXT (mullvad)][Plen Bins: 0,50,50,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/mullvad_wireguard.pcap.out b/tests/cfgs/default/result/mullvad_wireguard.pcap.out new file mode 100644 index 00000000000..b3e430b3d33 --- /dev/null +++ b/tests/cfgs/default/result/mullvad_wireguard.pcap.out @@ -0,0 +1,25 @@ +Guessed flow protos: 0 + +DPI Packets (UDP): 3 (3.00 pkts/flow) +Confidence DPI : 1 (flows) +Num dissector calls: 132 (132.00 diss/flow) +LRU cache ookla: 0/0/0 (insert/search/found) +LRU cache bittorrent: 0/0/0 (insert/search/found) +LRU cache zoom: 0/0/0 (insert/search/found) +LRU cache stun: 0/0/0 (insert/search/found) +LRU cache tls_cert: 0/0/0 (insert/search/found) +LRU cache mining: 0/0/0 (insert/search/found) +LRU cache msteams: 0/0/0 (insert/search/found) +LRU cache stun_zoom: 0/0/0 (insert/search/found) +Automa host: 0/0 (search/found) +Automa domain: 0/0 (search/found) +Automa tls cert: 0/0 (search/found) +Automa risk mask: 0/0 (search/found) +Automa common alpns: 0/0 (search/found) +Patricia risk mask: 0/0 (search/found) +Patricia risk: 0/0 (search/found) +Patricia protocols: 1/1 (search/found) + +WireGuard 10 1924 1 + + 1 UDP 192.168.122.11:22595 <-> 198.54.131.98:5060 [proto: 206/WireGuard][IP: 348/Mullvad][Encrypted][Confidence: DPI][DPI packets: 3][cat: VPN/2][6 pkts/828 bytes <-> 4 pkts/1096 bytes][Goodput ratio: 69/85][0.97 sec][bytes ratio: -0.139 (Mixed)][IAT c2s/s2c min/avg/max/stddev: 0/234 193/239 470/248 177/6][Pkt Len c2s/s2c min/avg/max/stddev: 122/122 138/274 202/714 29/254][Risk: ** Known Proto on Non Std Port **][Risk Score: 50][Risk Info: Expected on port 51820][Plen Bins: 0,0,60,20,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/srvloc.pcap.out b/tests/cfgs/default/result/srvloc.pcap.out index 2a8e1ab838a..b020e9bd582 100644 --- a/tests/cfgs/default/result/srvloc.pcap.out +++ b/tests/cfgs/default/result/srvloc.pcap.out @@ -18,7 +18,7 @@ Automa risk mask: 0/0 (search/found) Automa common alpns: 0/0 (search/found) Patricia risk mask: 1240/0 (search/found) Patricia risk: 1150/0 (search/found) -Patricia protocols: 1240/26 (search/found) +Patricia protocols: 1240/27 (search/found) Service_Location_Protocol 629 57125 620 @@ -523,7 +523,7 @@ Service_Location_Protocol 629 57125 620 499 UDP 185.31.153.50:50851 -> 186.112.202.53:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 500 UDP 185.33.65.208:52802 -> 74.111.203.55:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 501 UDP 185.211.4.13:55127 -> 90.111.212.50:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 502 UDP 185.213.154.138:52528 -> 165.114.202.61:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 502 UDP 185.213.154.138:52528 -> 165.114.202.61:427 [proto: 347/Service_Location_Protocol][IP: 348/Mullvad][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 503 UDP 186.27.5.237:51315 -> 90.147.171.51:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 504 UDP 186.213.158.225:51349 -> 69.109.187.54:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 505 UDP 186.213.158.225:53551 -> 90.111.212.50:427 [proto: 347/Service_Location_Protocol][IP: 0/Unknown][ClearText][Confidence: DPI][DPI packets: 1][cat: RPC/16][1 pkts/71 bytes -> 0 pkts/0 bytes][Goodput ratio: 40/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 100,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/tests/cfgs/default/result/synscan.pcap.out b/tests/cfgs/default/result/synscan.pcap.out index c76db311850..9e77b6c11fb 100644 --- a/tests/cfgs/default/result/synscan.pcap.out +++ b/tests/cfgs/default/result/synscan.pcap.out @@ -126,7 +126,7 @@ iSCSI 2 116 2 45 TCP 172.16.0.8:36050 -> 64.13.134.52:2605 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 46 TCP 172.16.0.8:36050 -> 64.13.134.52:3000 [proto: 26/ntop][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 47 TCP 172.16.0.8:36050 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 48 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 348/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 48 TCP 172.16.0.8:36050 -> 64.13.134.52:3260 [proto: 349/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 49 TCP 172.16.0.8:36050 -> 64.13.134.52:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 50 TCP 172.16.0.8:36050 -> 64.13.134.52:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 51 TCP 172.16.0.8:36050 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] @@ -191,7 +191,7 @@ iSCSI 2 116 2 110 TCP 172.16.0.8:36051 -> 64.13.134.52:2605 [proto: 13/BGP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 111 TCP 172.16.0.8:36051 -> 64.13.134.52:3000 [proto: 26/ntop][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 112 TCP 172.16.0.8:36051 -> 64.13.134.52:3128 [proto: 131/HTTP_Proxy][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Web/5][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] - 113 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 348/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] + 113 TCP 172.16.0.8:36051 -> 64.13.134.52:3260 [proto: 349/iSCSI][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 114 TCP 172.16.0.8:36051 -> 64.13.134.52:3306 [proto: 20/MySQL][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Database/11][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 115 TCP 172.16.0.8:36051 -> 64.13.134.52:3389 [proto: 88/RDP][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: RemoteAccess/12][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Desktop/File Sharing **** Unidirectional Traffic **][Risk Score: 20][Risk Info: No server to client traffic / Found RDP][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] 116 TCP 172.16.0.8:36051 -> 64.13.134.52:4343 [proto: 170/Whois-DAS][IP: 0/Unknown][ClearText][Confidence: Match by port][DPI packets: 1][cat: Network/14][1 pkts/58 bytes -> 0 pkts/0 bytes][Goodput ratio: 0/0][< 1 sec][Risk: ** Unidirectional Traffic **][Risk Score: 10][Risk Info: No server to client traffic][Plen Bins: 0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0] diff --git a/utils/mullvad_ip_addresses_download.sh b/utils/mullvad_ip_addresses_download.sh new file mode 100755 index 00000000000..837f1bda730 --- /dev/null +++ b/utils/mullvad_ip_addresses_download.sh @@ -0,0 +1,28 @@ +#!/usr/bin/env bash + +set -e + +cd "$(dirname "${0}")" || exit 1 +. ./common.sh || exit 1 + +DEST=../src/lib/inc_generated/ndpi_mullvad_match.c.inc +TMP=/tmp/mullvad.json +LIST=/tmp/mullvad.list +ORIGIN=https://api-www.mullvad.net/www/relays/all/ + + +echo "(1) Downloading file..." +http_response=$(curl -s -o $TMP -w "%{http_code}" ${ORIGIN}) +check_http_response "${http_response}" +is_file_empty "${TMP}" + +echo "(2) Processing IP addresses..." +jq -r '.[].ipv4_addr_in' $TMP > $LIST # TODO: ipv6 +is_file_empty "${LIST}" +./ipaddr2list.py $LIST NDPI_PROTOCOL_MULLVAD > $DEST +is_file_empty "${DEST}" + +rm -f $TMP $LIST + +echo "(3) Mullvad IPs are available in $DEST" +exit 0 diff --git a/utils/update_every_lists.sh b/utils/update_every_lists.sh index 95f72476e85..3f0f75adf75 100755 --- a/utils/update_every_lists.sh +++ b/utils/update_every_lists.sh @@ -36,6 +36,8 @@ RETVAL=$(( RETVAL + $? )) ./gambling_sites_download.sh RETVAL=$(( RETVAL + $? )) +./mullvad_ip_addresses_download.sh +RETVAL=$(( RETVAL + $? )) ./protonvpn_ip_addresses_download.sh RETVAL=$(( RETVAL + $? ))