Help required to identify protocols (Spotify)

--===============5610997432068845687==
Content-Type: multipart/alternative; boundary="0000000000007bc40c05a7189f10"

--0000000000007bc40c05a7189f10
Content-Type: text/plain; charset="UTF-8"

Greetings,

I'm mailing on this list for guidance. I want to learn adding a new
protocol or fixing an existing protocol in NDPI. I've collected spotify
packets and been comparing it with the results, the pcap dump is available
here (
https://drive.google.com/file/d/13sN3BkkxNdud2Nr8szeZJMSu3KOtvU35/view?usp=sharing
).
feeding this dump to ndpiReader I get the following stats.


Detected protocols:
DNS                  packets: 66            bytes: 9465          flows: 33

MDNS                 packets: 121           bytes: 11111         flows: 4

NetBIOS              packets: 15            bytes: 1380          flows: 1

SSDP                 packets: 157           bytes: 51525         flows: 48

SNMP                 packets: 4             bytes: 476           flows: 1

IGMP                 packets: 15            bytes: 682           flows: 6

TLS                  packets: 16095         bytes: 14205389      flows: 9

ICMPV6               packets: 12            bytes: 992           flows: 3

Google               packets: 706           bytes: 165715        flows: 9

LLMNR                packets: 42            bytes: 3370          flows: 22

Spotify              packets: 87            bytes: 27349         flows: 4

Microsoft365         packets: 98            bytes: 47219         flows: 4

MS_OneDrive          packets: 26            bytes: 7204          flows: 1

Following are few questions, I hope someone could make me understand this
process more clearly
Why does majority of packets go under TLS, I understand it might be using
TLS but shouldn't it be under Spotify? This means the spotify.c in
protocols needs to be fixed?
How do you guys infer packet protocols looking at the payload, I've seen
few checks with hardcoded bytes, but what if the payload changes our logic
would fail?

Regards,
Abid Zaidi

--0000000000007bc40c05a7189f10
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: base64

PGRpdiBkaXI9Imx0ciI+R3JlZXRpbmdzLDxkaXY+PGJyPjxkaXY+SSYjMzk7bSBtYWlsaW5nIG9u
IHRoaXMgbGlzdCBmb3IgZ3VpZGFuY2UuIEkgd2FudCB0byBsZWFybiBhZGRpbmcgYSBuZXcgcHJv
dG9jb2wgb3IgZml4aW5nIGFuIGV4aXN0aW5nIHByb3RvY29sIGluIE5EUEkuIEkmIzM5O3ZlIGNv
bGxlY3RlZCBzcG90aWZ5IHBhY2tldHMgYW5kIGJlZW4gY29tcGFyaW5nIGl0IHdpdGggdGhlIHJl
c3VsdHMsIHRoZSBwY2FwIGR1bXAgaXMgYXZhaWxhYmxlIGhlcmUgKMKgPGEgaHJlZj0iaHR0cHM6
Ly9kcml2ZS5nb29nbGUuY29tL2ZpbGUvZC8xM3NOM0Jra3hOZHVkMk5yOHN6ZVpKTVN1M0tPdHZV
MzUvdmlldz91c3A9c2hhcmluZyIgdGFyZ2V0PSJfYmxhbmsiPmh0dHBzOi8vZHJpdmUuZ29vZ2xl
LmNvbS9maWxlL2QvMTNzTjNCa2t4TmR1ZDJOcjhzemVaSk1TdTNLT3R2VTM1L3ZpZXc/dXNwPXNo
YXJpbmc8L2E+wqApLiBmZWVkaW5nIHRoaXMgZHVtcCB0byBuZHBpUmVhZGVyIEkgZ2V0IHRoZSBm
b2xsb3dpbmcgc3RhdHMuPC9kaXY+PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj48YnI+PC9kaXY+
PGJsb2NrcXVvdGUgc3R5bGU9Im1hcmdpbjowIDAgMCA0MHB4O2JvcmRlcjpub25lO3BhZGRpbmc6
MHB4Ij48ZGl2PkRldGVjdGVkIHByb3RvY29sczo8L2Rpdj48ZGl2PglETlMgwqAgwqAgwqAgwqAg
wqAgwqAgwqAgwqAgwqBwYWNrZXRzOiA2NiDCoCDCoCDCoCDCoCDCoCDCoGJ5dGVzOiA5NDY1IMKg
IMKgIMKgIMKgIMKgZmxvd3M6IDMzIMKgIMKgIMKgIMKgIMKgIDwvZGl2PjxkaXY+CU1ETlMgwqAg
wqAgwqAgwqAgwqAgwqAgwqAgwqAgcGFja2V0czogMTIxIMKgIMKgIMKgIMKgIMKgIGJ5dGVzOiAx
MTExMSDCoCDCoCDCoCDCoCBmbG93czogNCDCoCDCoCDCoCDCoCDCoCDCoDwvZGl2PjxkaXY+CU5l
dEJJT1MgwqAgwqAgwqAgwqAgwqAgwqAgwqBwYWNrZXRzOiAxNSDCoCDCoCDCoCDCoCDCoCDCoGJ5
dGVzOiAxMzgwIMKgIMKgIMKgIMKgIMKgZmxvd3M6IDEgwqAgwqAgwqAgwqAgwqAgwqA8L2Rpdj48
ZGl2PglTU0RQIMKgIMKgIMKgIMKgIMKgIMKgIMKgIMKgIHBhY2tldHM6IDE1NyDCoCDCoCDCoCDC
oCDCoCBieXRlczogNTE1MjUgwqAgwqAgwqAgwqAgZmxvd3M6IDQ4IMKgIMKgIMKgIMKgIMKgIDwv
ZGl2PjxkaXY+CVNOTVAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgcGFja2V0czogNCDCoCDCoCDC
oCDCoCDCoCDCoCBieXRlczogNDc2IMKgIMKgIMKgIMKgIMKgIGZsb3dzOiAxIMKgIMKgIMKgIMKg
IMKgIMKgPC9kaXY+PGRpdj4JSUdNUCDCoCDCoCDCoCDCoCDCoCDCoCDCoCDCoCBwYWNrZXRzOiAx
NSDCoCDCoCDCoCDCoCDCoCDCoGJ5dGVzOiA2ODIgwqAgwqAgwqAgwqAgwqAgZmxvd3M6IDYgwqAg
wqAgwqAgwqAgwqAgwqA8L2Rpdj48ZGl2PglUTFMgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqAgwqBw
YWNrZXRzOiAxNjA5NSDCoCDCoCDCoCDCoCBieXRlczogMTQyMDUzODkgwqAgwqAgwqBmbG93czog
OSDCoCDCoCDCoCDCoCDCoCDCoDwvZGl2PjxkaXY+CUlDTVBWNiDCoCDCoCDCoCDCoCDCoCDCoCDC
oCBwYWNrZXRzOiAxMiDCoCDCoCDCoCDCoCDCoCDCoGJ5dGVzOiA5OTIgwqAgwqAgwqAgwqAgwqAg
Zmxvd3M6IDMgwqAgwqAgwqAgwqAgwqAgwqA8L2Rpdj48ZGl2PglHb29nbGUgwqAgwqAgwqAgwqAg
wqAgwqAgwqAgcGFja2V0czogNzA2IMKgIMKgIMKgIMKgIMKgIGJ5dGVzOiAxNjU3MTUgwqAgwqAg
wqAgwqBmbG93czogOSDCoCDCoCDCoCDCoCDCoCDCoDwvZGl2PjxkaXY+CUxMTU5SIMKgIMKgIMKg
IMKgIMKgIMKgIMKgIMKgcGFja2V0czogNDIgwqAgwqAgwqAgwqAgwqAgwqBieXRlczogMzM3MCDC
oCDCoCDCoCDCoCDCoGZsb3dzOiAyMiDCoCDCoCDCoCDCoCDCoCA8L2Rpdj48ZGl2PglTcG90aWZ5
IMKgIMKgIMKgIMKgIMKgIMKgIMKgcGFja2V0czogODcgwqAgwqAgwqAgwqAgwqAgwqBieXRlczog
MjczNDkgwqAgwqAgwqAgwqAgZmxvd3M6IDQgwqAgwqAgwqAgwqAgwqAgwqA8L2Rpdj48ZGl2PglN
aWNyb3NvZnQzNjUgwqAgwqAgwqAgwqAgcGFja2V0czogOTggwqAgwqAgwqAgwqAgwqAgwqBieXRl
czogNDcyMTkgwqAgwqAgwqAgwqAgZmxvd3M6IDQgwqAgwqAgwqAgwqAgwqAgwqA8L2Rpdj48ZGl2
PglNU19PbmVEcml2ZSDCoCDCoCDCoCDCoCDCoHBhY2tldHM6IDI2IMKgIMKgIMKgIMKgIMKgIMKg
Ynl0ZXM6IDcyMDQgwqAgwqAgwqAgwqAgwqBmbG93czogMcKgIMKgPC9kaXY+PGRpdj48YnI+PC9k
aXY+PC9ibG9ja3F1b3RlPjxkaXY+Rm9sbG93aW5nIGFyZSBmZXfCoHF1ZXN0aW9ucyzCoEkgaG9w
ZSBzb21lb25lIGNvdWxkIG1ha2UgbWUgdW5kZXJzdGFuZCB0aGlzIHByb2Nlc3MgbW9yZSBjbGVh
cmx5PC9kaXY+PGRpdj5XaHkgZG9lcyBtYWpvcml0ecKgb2YgcGFja2V0cyBnbyB1bmRlciBUTFMs
IEkgdW5kZXJzdGFuZCBpdCBtaWdodCBiZSB1c2luZyBUTFMgYnV0IHNob3VsZG4mIzM5O3QgaXQg
YmUgdW5kZXIgU3BvdGlmeT8gVGhpcyBtZWFucyB0aGUgc3BvdGlmeS5jIGluIHByb3RvY29scyBu
ZWVkcyB0byBiZSBmaXhlZD88L2Rpdj48ZGl2PkhvdyBkbyB5b3UgZ3V5cyBpbmZlciBwYWNrZXQg
cHJvdG9jb2xzIGxvb2tpbmfCoGF0IHRoZSBwYXlsb2FkLCBJJiMzOTt2ZSBzZWVuIGZldyBjaGVj
a3Mgd2l0aCBoYXJkY29kZWQgYnl0ZXMsIGJ1dCB3aGF0IGlmIHRoZSBwYXlsb2FkIGNoYW5nZXMg
b3VyIGxvZ2ljIHdvdWxkIGZhaWw/PC9kaXY+PGRpdj48YnI+PC9kaXY+PGRpdj5SZWdhcmRzLDwv
ZGl2PjxkaXY+QWJpZCBaYWlkaTwvZGl2PjwvZGl2Pg0K
--0000000000007bc40c05a7189f10--

--===============5610997432068845687==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
Ntop-dev mailing list
[email protected]
http://listgateway.unipi.it/mailman/listinfo/ntop-dev
--===============5610997432068845687==--