From 9eb308d84cb7540c8f5b0b4ea141fae52e88deef Mon Sep 17 00:00:00 2001 From: bol-van Date: Mon, 12 Jan 2026 10:09:02 +0300 Subject: [PATCH] update docs --- docs/manual.en.md | 6 +++--- docs/manual.md | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/manual.en.md b/docs/manual.en.md index 6a4c1db..59c13f8 100644 --- a/docs/manual.en.md +++ b/docs/manual.en.md @@ -707,7 +707,7 @@ LOGICAL NETWORK FILTER: ## Protocol detection nfqws2 signatures the payload types of individual packets or groups of packets. -All packets without data have payload empty, undetected - unknown. +All packets without data have payload empty. Undetermined payloads have payload type "unknown". The flow protocol is assigned after receiving the first known payload and remains with the flow for the rest of its existence. In this case, subsequent payloads can have both a known type and an unknown one. In payload and flow protocol filters special values are available - "all" and "known". "all" means any, "known" - not "empty" and not "unknown". @@ -1304,8 +1304,8 @@ desync | replay_piece | number | index of the part being replayed | 1-based indexing | | replay_piece_count | number | total number of parts being replayed | | | replay_piece_last | bool | indicates the last part being replayed | | -| l7payload | string | payload type of the current packet or packet group; see nfqws2 help for the list | defaults to "unknown" if undetermined | -| l7proto | string | stream protocol type | defaults to "unknown" if undetermined | +| l7payload | string | [payload type](#protocol-detection) of the current packet or packet group | defaults to "unknown" if undetermined | +| l7proto | string | [flow protocol(#protocol-detection) | defaults to "unknown" if undetermined | | reasm_data | string | result of reassembling a multi-packet message, or the payload itself if no reassembly occurred | currently applied only to TCP | | reasm_offset | string | offset of the current replayed packet within the reassembled data | currently applied only to TCP | diff --git a/docs/manual.md b/docs/manual.md index 95f716a..2d930d9 100644 --- a/docs/manual.md +++ b/docs/manual.md @@ -776,11 +776,11 @@ nfqws2 сигнатурно распознает типы пейлоадов о | tls | tcp | tls_client_hello
tls_server_hello | | xmpp | tcp | xmpp_stream
xmpp_starttls
xmpp_proceed
xmpp_features | | quic | udp | quic_initial | -| wireguarв | udp | wireguard_initiation
wireguard_response
wireguard_cookie
wireguard_keepalive | +| wireguard | udp | wireguard_initiation
wireguard_response
wireguard_cookie
wireguard_keepalive | | dht | udp | dht | | discord | udp | discord_ip_discovery | | stun | udp | stun | -| dns | udp | dns_query dns_response | +| dns | udp | dns_query
dns_response | | mtproto | udp | mtproto_initial | | dtls | udp | dtls_client_hello
dtls_server_hello | @@ -1444,7 +1444,7 @@ desync | replay_piece_count | number | количество проигрываемых частей | | | replay_piece_last | bool | последняя проигрываемая часть | | | l7payload | string | [тип пейлоада](#распознавание-протоколов) текущего пакета или группы пакетов | если неизвестно - unknown | -| l7proto | string | тип протокола потока | если неизвестно - unknown | +| l7proto | string | тип [протокола потока](#распознавание-протоколов) | если неизвестно - unknown | | reasm_data | string | результат сборки многопакетного сообщения, либо сам пейлоад, если сборки не было | пока применяется только для tcp | | reasm_offset | string | смещение текущего переигрываемого пакета в сборке | пока применяется только для tcp | | decrypt_data | string | результат сборки и дешифровки пейлоада или пейлоадов нескольких пакетов | применяется для quic |