Calls: Whatsapp vs Messenger

[IvanNardi]

We should try harder to tell Whatsapp calls from FB Messenger ones

[kalindafab]

Hi @IvanNardi i'm new to nDPI and really interested in contributing to this project especially around protocol detection like distinguishing WhatsApp calls from Facebook Messenger calls (as discussed in this issue).
I'm still getting familiar with the codebase, so I was wondering:

• Is there a contribution guide or setup instructions to properly install and build nDPI?
• Are there any best practices or contribution guidelines I should follow (e.g., formatting, tests, where to add new protocol logic)?

I’d love to learn by doing and help out even if it's something small at first. any pointers you could share would mean a lot. Thanks in advance and really appreciate all the work you’ve done on this project!

[IvanNardi]

• Is there a contribution guide or setup instructions to properly install and build nDPI?

@kalindafab I think the best documentation (and, unfortunately, the only one) is the main README file

• Are there any best practices or contribution guidelines I should follow (e.g., formatting, tests, where to add new protocol logic)?

Nothing explicit. About coding style, try to stick to the one already used in the file that you are changing

Usually, adding a new protocol via domain matching is the simplest way to work on nDPI code. For example: 137d87f

Adding a new protocol with a real dissector code (simple example: 81eaa3b) is a little bit more complex but usually feasible

Changing STUN/TLS/QUIC code is definitely harder. Unfortunately, this issue is about this last case...

Let me know if you need specific information

[kalindafab]

Thanks for the clarification and examples they really help me understand how things are structured!

Since the issue here (distinguishing WhatsApp from Messenger) touches on STUN/TLS/QUIC and is a bit more advanced, I was wondering if there are any simpler protocol detection tasks, forgotten dissectors, or even small improvements (like domain-based additions) that might be good for a beginner contributor like me?

Happy to dig into anything helpful even if it’s cleaning up or improving something small. I really appreciate the guidance and am excited to contribute!

[0xA50C1A1]

Thanks for the clarification and examples they really help me understand how things are structured!

Since the issue here (distinguishing WhatsApp from Messenger) touches on STUN/TLS/QUIC and is a bit more advanced, I was wondering if there are any simpler protocol detection tasks, forgotten dissectors, or even small improvements (like domain-based additions) that might be good for a beginner contributor like me?

Happy to dig into anything helpful even if it’s cleaning up or improving something small. I really appreciate the guidance and am excited to contribute!

Hey, glad you're excited to contribute! Here are a few beginner-friendly ideas:

• Blacknut, Boosteroid (cloud gaming): simple SNI-based detection.
• Rumble (streaming): also SNI-based - should be straightforward.

Not so beginner-friendly:

• Thread / Matter (IoT): IPv6-only, but specs might make it trickier. Fun if you’re up for a challenge.
• Palworld, Marvel Rivals, Lost Ark, Throne and Liberty (games): Might need more digging

Pick whatever interests you. Even small SNI additions are great starters.

[pcbaldwin]

Hey @IvanNardi - I'm a long-time listener, first-time caller!

These are just some findings in case it helps others.

I ran a handful of tests to compare Instagram Calls and WhatsApp Calls. I can see Instagram doing parallel TURN/STUN requests:

• 31.13.80.55 port 40003 - rDNS: edge-turnservice-shv-01-yyz1.facebook.com (Toronto)
• 31.13.80.128 port 3478 - rDNS: edgeray-msgr-shv-01-yyz1.facebook.com (Toronto)
• 157.240.254.58 port 3478 - rDNS: edgeray-msgr-shv-02-ord5.facebook.com (Chicago)
• 157.240.241.53 port 3478 - rDNS: edgeray-msgr-shv-02-lga3.facebook.com (New York)

I'm in Toronto FWIW. The last 3 requests have the 0x4000 attribute set, so these fall into the WhatsApp STUN detection. The actual call is done on the first connection via the TURN server. That has the Facebook VoIP detection since that connection does not have the 0x4000 attribute, and it does have the STUN realm set to "turner.facebook". Nice!

WhatsApp behaves similarly. Four parallel connections right at the start;

• 31.13.80.50 port 3478 - rDNS edgeray-shv-01-yyz1.facebook.com (Toronto)
• 31.13.71.48 port 3478 - rDNS edgeray-shv-01-lga3.facebook.com (New York)
• 57.144.205.48 port 3478 - rDNS edgeray-shv-01-ord5.facebook.com (Chiiago)
• 57.144.173.48 port 3478 - rDNS edgeray-shv-01-det1.facebook.com (Detroit)

Note the difference in the reverse DNS prefix compared to Instagram. The extra msgr indicates infrastructure for Facebook Messenger (and sometimes Instagram).

Even though the infrastructure between WhatsApp and Facebook/Instagram is separate, the connection behaviors in Wireshark look very similar (e.g. four parallel connections with 1 millisecond).

Unfortunately, my current environment for capturing traffic is not great for this testing (NAT/TURN issues). I can't avoid TURN servers in Instagram, so it's a bit of an apples and oranges comparison at the moment. I'll need to find a better STUN-friendly test environment and dig deeper on this one.

[mmanoj]

@pcbaldwin I’m encountering challenges in effectively blocking WhatsApp traffic via my forwarding gateway using nDPI. It appears nDPI is not fully identifying complete flows, exhibiting behavior similar to what we discussed previously.

Current Setup:
WiFi → Linux Box (with IP Forwarding + nDPI_NFQUEUE) → Internet

Request:
I would like to investigate this deeper and will share relevant PCAP files from my environment for analysis. Could we schedule a troubleshooting session or review the traffic patterns together?

[IvanNardi]

I’m encountering challenges in effectively blocking WhatsApp traffic

This is unexpected. Some Messenger calls are misclassified as WA (that is the reason for this ticket...) but all WA calls should be classified as such.
I would be very interested to see a WA call not properly classified

[mmanoj]

@IvanNardi Thx for the quick feedback.I'm working on more traces and packet captures with my env.Will update you the progress and samples with tested logic/blocking logic.

[IvanNardi]

Instagram Calls

@pcbaldwin, sorry I missed your post....
First thing first: do you mean that you can make audio/video call using only Instagram app?? I completely missed that!!