Instagram traffic classified as FACEBOOK_REEL_STORY in nDPI 5.0 instead of INSTAGRAM (regression from 4.14) #3089
Description
Hi,
Ι noticed a classification change when upgrading from nDPI 4.14 to 5.0.
Using the same pcap with ndpiReader:
- 4.14 → INSTAGRAM
- 5.0 → FACEBOOK_REEL_STORY
The Server Name (SNI) present in the pcap I am using is instagram.fnic2-2.fna.fbcdn.net.
In ndpi_content_match, I can see rules such as:
- "instagram." → NDPI_PROTOCOL_INSTAGRAM
- "fna.fbcdn.net" → NDPI_PROTOCOL_FACEBOOK_REEL_STORY
I was wondering whether this could be related to rule matching order or priority. Since the hostname seems to match both Instagram and Facebook Reel Story rules, is it possible that in nDPI 5.0 the later match overrides the earlier one, whereas in 4.14 the first match was kept?
Is this an expected change in 5.0? I just want to make sure I understand the intended matching logic.
Thank you in advance.