Ivan Nardi

> So IMHO IP classification can either be a third-level protocol (e.g. HTTP.SOAP.Microsoft) or another "attribute" of the traffic similar to breed: in essence they are similar but we need...

Just to be sure, you would like: 1) having a separate field with the "by-ip classification" (pretty much what we already have in `flow->guessed_host_protocol_id`); OR 2) having a separate field...

I agree that removing "ip-classificaton" from `flow->detected_protocol_stack[]` might be a good idea, in general. For example, as noted in #1425, classifications as `NTP/Apple`, `BitTorrent/Azure`, `DNScrypt.AmazonAWS` don't make any sense, IMO....

Some of these info will be available when https://github.com/ntop/nDPI/pull/1677 is merged

> avg no of dissectors involved in detection Already available ``` ./example/ndpiReader -t -i ./tests/pcap/whatsapp_login_call.pcap [...] Num dissector calls: 236 (4.14 diss/flow) ```

I am not able to trigger the error neither with master or with b2b61011. Could you share some more information about your enviroment please (os, compiler version, configure flags...)?

@alihushyar , any updates?

Closing for inactivity. If you still have some issues, please open a new updated ticket. Thanks

@charlesg , could you share some pcaps, please?

We had the exact same issue and we solved it in the same way :-) Each protocol has an "internal-id" (used throughout the code, mutable, unknown to the user) and...