Hi, I've already compiled OpenDPI(Deep protocol inspection) as a separate kernel module. Now, the question is if it's better to use it as a pfring plugin or to use quick mode and patch pfring. Btw, i'll need OpenDpi result for clustering packets. Regards Mohammadreza