DNS traffic is classified and Unknown
Attached sample PCAP

Enabled no guess by port

nDPI Environment (please complete the following information):
Ubuntu 22.04
OS22.04
Architecture: amd64
nDPI 4.14

./ndpiReader -i /home/ubuntu/dns_tcp_other_ip.pcap -d

• NOTE: This is demo app to show some nDPI features.
• In this demo we have implemented only some basic features
• just to show you what you can do with the library. Feel
• free to extend it and send us the patches for inclusion

Using nDPI (4.14.0-5235-f2a9087) [1 thread(s)]
Using libgcrypt version 1.8.6internal
Reading packets from pcap file /home/ubuntu/dns_tcp_other_ip.pcap...
Running thread 0...

nDPI Memory statistics:
nDPI Memory (once): 42.82 KB
Flow Memory (per flow): 1.15 KB
Actual Memory: 11.05 MB
Peak Memory: 11.05 MB
Setup Time: 29 msec
Packet Processing Time: 0 msec

Traffic statistics:
Ethernet bytes: 1094 (includes ethernet CRC/IFC/trailer)
Discarded bytes: 0
IP packets: 11 of 11 packets total
IP bytes: 830 (avg pkt size 75 bytes)
Unique flows: 1
TCP Packets: 11
UDP Packets: 0
VLAN Packets: 0
MPLS Packets: 0
PPPoE Packets: 0
Fragmented Packets: 0
Max Packet size: 114
Packet Len < 64: 9
Packet Len 64-128: 2
Packet Len 128-256: 0
Packet Len 256-1024: 0
Packet Len 1024-1500: 0
Packet Len > 1500: 0
nDPI throughput: 27.78 K pps / 21.08 Mb/sec
Analysis begin: 26/May/2026 10:36:44
Analysis end: 26/May/2026 10:36:44
Traffic throughput: 523.81 K pps / 397.46 Mb/sec
Traffic duration: 0.000 sec
DPI Packets (TCP): 11 (11.00 pkts/flow)
Confidence: Unknown 1 (flows)

Detected protocols:
Unknown packets: 11 bytes: 830 flows: 1

Protocol statistics:
Unrated packets: 11 bytes: 830 flows: 1

dns_tcp_other_ip.pcap.txt