Facebook miss classification

[netcons]

Hi Vitaly, looks like WhatsApp flows are being detected as Facebook:

host mmx-ds.cdn.whatsapp.net
mmx-ds.cdn.whatsapp.net has address 102.132.104.60

cat /proc/net/xt_ndpi/flows | grep 102.132.104.60 | grep 5222
1779181021 1779181197 4 6 192.168.3.191 65101 102.132.104.60 5222 6064 6195 37 37 I=2,3 SN=141.169.146.186,65101 P=WhatsApp,TLS H=web.whatsapp.com c=t13d1516h1_8daaf6152771_0d365e64def3 R=5
1779181198 1779181200 4 6 192.168.3.191 49673 102.132.104.60 5222 7791 52 7 1 I=2,3 SN=141.169.146.186,49673 P=Facebook

Suspect Commit 307643d

[netcons]

ndpiReader seems to detect it correctly:

tcpdump -ni ens18 -s 0 -w /var/tmp/whatsapp.pcap -v host 102.132.104.60 and port 5222
ndpiReader -i /var/tmp/whatsapp.pcap

Using nDPI (5.1.0-5755-a6fa739) [1 thread(s)]
Using libgcrypt version 1.8.6internal
Reading packets from pcap file /var/tmp/whatsapp.pcap...
Running thread 0...

nDPI Memory statistics:
        nDPI Memory (once):      3.55 KB
        Flow Memory (per flow):  1.27 KB
        Total memory allocated:  9.47 MB
        Setup Time:              50 msec
        Packet Processing Time:  4 msec

Traffic statistics:
        Ethernet bytes:        150992        (includes ethernet CRC/IFC/trailer)
        Discarded bytes:       1115583
        IP packets:            1857          of 4340 packets total
        IP bytes:              106424        (avg pkt size 24 bytes)
        Unique flows:          54
        TCP Packets:           1857
        UDP Packets:           0
        VLAN Packets:          0
        MPLS Packets:          0
        PPPoE Packets:         0
        Fragmented Packets:    0
        Max Packet size:       21
        Packet Len < 64:       1857
        Packet Len 64-128:     0
        Packet Len 128-256:    0
        Packet Len 256-1024:   0
        Packet Len 1024-1500:  0
        Packet Len > 1500:     0
        nDPI throughput:       428.27 K pps / 265.68 Mb/sec
        Analysis begin:        13/Aug/2026 09:08:11
        Analysis end:          13/Aug/2026 09:13:26
        Traffic throughput:    5.90 pps / 3.75 Kb/sec
        Traffic duration:      314.923 sec
        Guessed flow protos:   54
        DPI Packets (TCP):     1096          (20.30 pkts/flow)
        Confidence: Match by IP 54            (flows)


Detected protocols:
        WhatsApp             packets: 1857          bytes: 106424        flows: 54