{"action":"closed","issue":{"url":"https://api.github.com/repos/ntop/nDPI/issues/195","repository_url":"https://api.github.com/repos/ntop/nDPI","labels_url":"https://api.github.com/repos/ntop/nDPI/issues/195/labels{/name}","comments_url":"https://api.github.com/repos/ntop/nDPI/issues/195/comments","events_url":"https://api.github.com/repos/ntop/nDPI/issues/195/events","html_url":"https://github.com/ntop/nDPI/issues/195","id":155647204,"number":195,"title":"What's the method used in nDPI to discover features of an application's payload","user":{"login":"tianzhishuizhu","id":12470646,"avatar_url":"https://avatars.githubusercontent.com/u/12470646?v=3","gravatar_id":"","url":"https://api.github.com/users/tianzhishuizhu","html_url":"https://github.com/tianzhishuizhu","followers_url":"https://api.github.com/users/tianzhishuizhu/followers","following_url":"https://api.github.com/users/tianzhishuizhu/following{/other_user}","gists_url":"https://api.github.com/users/tianzhishuizhu/gists{/gist_id}","starred_url":"https://api.github.com/users/tianzhishuizhu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tianzhishuizhu/subscriptions","organizations_url":"https://api.github.com/users/tianzhishuizhu/orgs","repos_url":"https://api.github.com/users/tianzhishuizhu/repos","events_url":"https://api.github.com/users/tianzhishuizhu/events{/privacy}","received_events_url":"https://api.github.com/users/tianzhishuizhu/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2016-05-19T03:28:03Z","updated_at":"2016-05-19T08:03:30Z","closed_at":"2016-05-19T08:03:30Z","body":"What's the **method or algorithm** used in summarying features of an application's payload? Are these features found by programmers inspecting every packet or Automation method？Thanks! Because there are so many applications and protocols. How to improve efficiency to summary features of application's payload?\r\n\r\nFor example, for detecting application qq, qq.c comment is:\r\n```\r\n/*a qq client packet looks like this:\r\n *\r\n * TCP packets starts with 16 bit length, then the normal packets follows\r\n * \r\n * 0 1 byte packet tag (usually 0x02)\r\n * 1 2 byte client tag (client version)\r\n * 3 2 byte command\r\n * 5 2 byte sequence number\r\n * 7 4 byte userid\r\n * 11 x bytes data\r\n * LAST 1 byte packet tail (usually 0x03)\r\n```"}}