Toni
Is this issue still valid? If so, I would appreciate a PCAP.
Could you please provide some pcaps?
@mmanoj I am working on it. But for now I can not promise that the detection of every VPN you've mentioned will be possible.
I am working on the UltraSurf PCAP. But besides some background traffic to third party services, there is nothing interesting in it.
PR #1615 may detect TunnelBear VPN. The rest of the PCAPs did not contain any interesting patterns.
I think something went wrong. There are TLS flows with missing handshakes. They could be of interest.
I am unsure if this pattern is stable. Can you try #1618 and check if it does detect UltraSurf VPN more or less reliable? There are two TLSv1.3 flows with...
Does the UltraSurf detection work as expected?
> Pls find the latest captures, it didn't detect [ultra_rx_20220707_052251_86723.zip](https://github.com/ntop/nDPI/files/9061227/ultra_rx_20220707_052251_86723.zip) It is apparently not so easy to reliably detect UltraSurf. > I saw some pattern 17 03 03 but in...
> **16 03 01** 02 00 01 00 01 fc **03 03** 3b b6 68 fc 96 The pattern belongs to a TLSv1.3 client hello.