{"action":"created","issue":{"url":"https://api.github.com/repos/ntop/nDPI/issues/103","labels_url":"https://api.github.com/repos/ntop/nDPI/issues/103/labels{/name}","comments_url":"https://api.github.com/repos/ntop/nDPI/issues/103/comments","events_url":"https://api.github.com/repos/ntop/nDPI/issues/103/events","html_url":"https://github.com/ntop/nDPI/issues/103","id":110435066,"number":103,"title":"dissection support for ports 5228 and 5221 that chrome uses","user":{"login":"Tomasu","id":1405892,"avatar_url":"https://avatars.githubusercontent.com/u/1405892?v=3","gravatar_id":"","url":"https://api.github.com/users/Tomasu","html_url":"https://github.com/Tomasu","followers_url":"https://api.github.com/users/Tomasu/followers","following_url":"https://api.github.com/users/Tomasu/following{/other_user}","gists_url":"https://api.github.com/users/Tomasu/gists{/gist_id}","starred_url":"https://api.github.com/users/Tomasu/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Tomasu/subscriptions","organizations_url":"https://api.github.com/users/Tomasu/orgs","repos_url":"https://api.github.com/users/Tomasu/repos","events_url":"https://api.github.com/users/Tomasu/events{/privacy}","received_events_url":"https://api.github.com/users/Tomasu/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-10-08T12:10:21Z","updated_at":"2015-10-08T13:07:49Z","closed_at":null,"body":"Based on some googling, it looks like they are originally XMPP ports, but chrome is passing some binary data over the connection. The first few bytes are somewhat similar between packets, but there are some variances. I'm not sure how to figure this out without knowing more about the protocol.\r\n\r\nhttp://tomasu.net/~moose/5228.pcap"},"comment":{"url":"https://api.github.com/repos/ntop/nDPI/issues/comments/146537927","html_url":"https://github.com/ntop/nDPI/issues/103#issuecomment-146537927","issue_url":"https://api.github.com/repos/ntop/nDPI/issues/103","id":146537927,"user":{"login":"kYroL01","id":7222956,"avatar_url":"https://avatars.githubusercontent.com/u/7222956?v=3","gravatar_id":"","url":"https://api.github.com/users/kYroL01","html_url":"https://github.com/kYroL01","followers_url":"https://api.github.com/users/kYroL01/followers","following_url":"https://api.github.com/users/kYroL01/following{/other_user}","gists_url":"https://api.github.com/users/kYroL01/gists{/gist_id}","starred_url":"https://api.github.com/users/kYroL01/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kYroL01/subscriptions","organizations_url":"https://api.github.com/users/kYroL01/orgs","repos_url":"https://api.github.com/users/kYroL01/repos","events_url":"https://api.github.com/users/kYroL01/events{/privacy}","received_events_url":"https://api.github.com/users/kYroL01/received_events","type":"User","site_admin":false},"created_at":"2015-10-08T13:07:49Z","updated_at":"2015-10-08T13:07:49Z","body":"I launched this pcap with ndpiReader and i have this results:\r\n** SSL_No_Cert          packets: 40            bytes: 7452          flows: 2            \r\n   Google               packets: 14            bytes: 2218          flows: 2 **\r\n\r\nSo, what's wrong ? nDPI cannot base dissection only on ports without an associated protocol.\r\nDo you think that these ports are only used by the XMPP protocol ?\r\nPlease, explain better what is your question."}}