aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
Diffstat
-rw-r--r--example/ndpiReader.c207
-rw-r--r--src/include/ndpi_protocol_ids.h13
-rw-r--r--src/include/ndpi_protocols.h2
-rw-r--r--src/include/ndpi_typedefs.h1
-rw-r--r--src/lib/Makefile.am1
-rw-r--r--src/lib/ndpi_content_match.c.inc25
-rw-r--r--src/lib/ndpi_main.c33
-rw-r--r--src/lib/protocols/SOMEIP.c223
-rw-r--r--src/lib/protocols/mdns.c37
-rw-r--r--wireshark/ndpi.lua82
10 files changed, 561 insertions, 63 deletions
diff --git a/example/ndpiReader.c b/example/ndpiReader.c
index 6d5f5d5ee..4e84bd7fc 100644
--- a/example/ndpiReader.c
+++ b/example/ndpiReader.c
@@ -91,14 +91,14 @@ static u_int32_t num_flows;
struct info_pair{
char addr[48];
- char proto[48]; /*l4 protocol*/
+ char proto[48]; /*app level protocol*/
int count;
};
typedef struct node_a{
char addr[48];
int count;
- char proto[48]; /*l4 protocol*/
+ char proto[48]; /*app level protocol*/
struct node_a *left, *right;
}addr_node;
@@ -121,7 +121,6 @@ struct top_stats {
char top_ip[48]; /*ip address that is contributed to > 95% of traffic*/
char proto[64]; /*application level protocol of top_ip */
u_int32_t num_pkts;
- float prcnt_pkt; /*percent of packets respect to total packets */
u_int32_t num_addr; /*to hold number of distinct IP addresses */
u_int32_t num_flows;
UT_hash_handle hh; /* makes this structure hashable */
@@ -130,6 +129,23 @@ struct top_stats {
struct top_stats *topSrcStats = NULL, *topDstStats = NULL;
+// struct to hold count of flows received by destination ports
+struct port_flow_info {
+ u_int32_t port; /* key */
+ u_int32_t num_flows;
+ UT_hash_handle hh;
+};
+
+// struct to hold single packet tcp flows send by source ip address
+struct single_flow_info {
+ char saddr[48]; /* key */
+ struct port_flow_info *ports;
+ u_int32_t tot_flows;
+ UT_hash_handle hh;
+};
+
+struct single_flow_info *scannerHosts = NULL;
+
struct ndpi_packet_trailer {
u_int32_t magic; /* 0x19682017 */
u_int16_t master_protocol /* e.g. HTTP */, app_protocol /* e.g. FaceBook */;
@@ -811,6 +827,47 @@ static void node_proto_guess_walker(const void *node, ndpi_VISIT which, int dept
/* *********************************************** */
+void updateScanners(struct single_flow_info **scanners, const char *saddr, u_int32_t dport){
+ struct single_flow_info *f;
+
+ HASH_FIND_STR(*scanners, saddr, f);
+
+ if(f == NULL) {
+ f = (struct single_flow_info*)malloc(sizeof(struct single_flow_info));
+ if(!f) return;
+ strncpy(f->saddr, saddr, sizeof(f->saddr));
+ f->tot_flows = 1;
+ f->ports = NULL;
+
+ HASH_ADD_STR(*scanners, saddr, f);
+
+ struct port_flow_info *p = (struct port_flow_info*)malloc(sizeof(struct port_flow_info));
+ if(!p) return;
+ p->port = dport;
+ p->num_flows = 1;
+
+ HASH_ADD_INT(f->ports, port, p);
+ }
+ else{
+ struct port_flow_info *pp;
+ f->tot_flows++;
+
+ HASH_FIND_INT(f->ports, &dport, pp);
+
+ if(pp == NULL){
+ pp = (struct port_flow_info*)malloc(sizeof(struct port_flow_info));
+ if(!pp) return;
+ pp->port = dport;
+ pp->num_flows = 1;
+
+ HASH_ADD_INT(f->ports, port, pp);
+ }
+ else pp->num_flows++;
+ }
+}
+
+/* *********************************************** */
+
int updateIpTree(const char *key, addr_node **vrootp, const char *proto) {
addr_node *q;
addr_node **rootp = vrootp;
@@ -920,7 +977,7 @@ static void updatePortStats(struct port_stats **stats, u_int32_t port,
s = (struct port_stats*)malloc(sizeof(struct port_stats));
if(!s) return;
- s->port = port, s->num_pkts = num_pkts, s->num_bytes = num_bytes,
+ s->port = port, s->num_pkts = num_pkts, s->num_bytes = num_bytes;
s->num_addr = 1, s->cumulative_addr = 1; s->num_flows = 1;
memset(s->top_ip_addrs, 0, MAX_NUM_IP_ADDRESS*sizeof(struct info_pair));
@@ -953,6 +1010,22 @@ static void updatePortStats(struct port_stats **stats, u_int32_t port,
/* *********************************************** */
+static void deleteScanners(struct single_flow_info *scanners){
+ struct single_flow_info *s, *tmp;
+ struct port_flow_info *p, *tmp2;
+
+ HASH_ITER(hh, scanners, s, tmp) {
+ HASH_ITER(hh, s->ports, p, tmp2) {
+ HASH_DEL(s->ports, p);
+ free(s->ports);
+ }
+ HASH_DEL(scanners, s);
+ free(s);
+ }
+}
+
+/* *********************************************** */
+
static void deletePortsStats(struct port_stats *stats) {
struct port_stats *current_port, *tmp;
@@ -976,6 +1049,7 @@ static void port_stats_walker(const void *node, ndpi_VISIT which, int depth, voi
char saddr[48], daddr[48];
char proto[48];
u_int16_t thread_id = *(int *)user_data;
+ int r;
sport = ntohs(flow->src_port), dport = ntohs(flow->dst_port);
strncpy(saddr, flow->src_name, sizeof(saddr));
@@ -989,8 +1063,14 @@ static void port_stats_walker(const void *node, ndpi_VISIT which, int depth, voi
strncpy(proto, ndpi_get_proto_name(ndpi_thread_info[thread_id].workflow->ndpi_struct,
flow->detected_protocol.app_protocol),sizeof(proto));
+ if(((r = strcmp(ipProto2Name(flow->protocol), "TCP")) == 0)
+ && (flow->src2dst_packets == 1) && (flow->dst2src_packets == 0)){
+
+ updateScanners(&scannerHosts, saddr, dport);
+ }
+
updatePortStats(&srcStats, sport, saddr, flow->src2dst_packets, flow->src2dst_bytes, proto);
- if(flow->dst2src_packets > 0) updatePortStats(&dstStats, dport, daddr, flow->dst2src_packets, flow->dst2src_bytes, proto);
+ updatePortStats(&dstStats, dport, daddr, flow->dst2src_packets, flow->dst2src_bytes, proto);
}
}
@@ -1252,6 +1332,24 @@ static int port_stats_sort(void *_a, void *_b) {
/* *********************************************** */
+static int scanners_sort(void *_a, void *_b) {
+ struct single_flow_info *a = (struct single_flow_info *)_a;
+ struct single_flow_info *b = (struct single_flow_info *)_b;
+
+ return(b->tot_flows - a->tot_flows);
+}
+
+/* *********************************************** */
+
+static int scanners_port_sort(void *_a, void *_b) {
+ struct port_flow_info *a = (struct port_flow_info *)_a;
+ struct port_flow_info *b = (struct port_flow_info *)_b;
+
+ return(b->num_flows - a->num_flows);
+}
+
+/* *********************************************** */
+
static int info_pair_cmp (const void *_a, const void *_b)
{
struct info_pair *a = (struct info_pair *)_a;
@@ -1284,7 +1382,7 @@ static void deleteTopStats(struct top_stats *stats) {
/**
* @brief Get port based top statistics
*/
-static int getTopStats(struct top_stats **topStats, struct port_stats *stats, u_int64_t total_packet_count){
+static int getTopStats(struct top_stats **topStats, struct port_stats *stats){
struct top_stats *s;
struct port_stats *sp, *tmp;
struct info_pair inf;
@@ -1297,7 +1395,6 @@ static int getTopStats(struct top_stats **topStats, struct port_stats *stats, u_
s->port = sp->port;
s->num_pkts = sp->num_pkts;
- s->prcnt_pkt = (sp->num_pkts*100.0)/total_packet_count;
s->num_addr = sp->num_addr;
s->num_flows = sp->num_flows;
@@ -1321,10 +1418,62 @@ static int getTopStats(struct top_stats **topStats, struct port_stats *stats, u_
/* *********************************************** */
#ifdef HAVE_JSON_C
+static void saveScannerStats(json_object **jObj_group, struct single_flow_info *scanners){
+ struct single_flow_info *s, *tmp;
+ struct port_flow_info *p, *tmp2;
+ json_object *jArray_stats = json_object_new_array();
+ int i = 0, j = 0;
+
+ HASH_SORT(scanners, scanners_sort);
+
+
+ HASH_ITER(hh, scanners, s, tmp) {
+ json_object *jObj_stat = json_object_new_object();
+ json_object *jArray_ports = json_object_new_array();
+
+ json_object_object_add(jObj_stat,"ip.address",json_object_new_string(s->saddr));
+ json_object_object_add(jObj_stat,"total.flows.number",json_object_new_int(s->tot_flows));
+
+ HASH_SORT(s->ports, scanners_port_sort);
+
+ HASH_ITER(hh, s->ports, p, tmp2) {
+ json_object *jObj_port = json_object_new_object();
+
+ json_object_object_add(jObj_port,"port",json_object_new_int(p->port));
+ json_object_object_add(jObj_port,"flows.number",json_object_new_int(p->num_flows));
+
+ json_object_array_add(jArray_ports, jObj_port);
+
+ j++;
+ if(j >= 10) break;
+ }
+
+ json_object_object_add(jObj_stat,"top.ports",jArray_ports);
+ json_object_array_add(jArray_stats, jObj_stat);
+
+ j = 0;
+ i++;
+ if(i >= 10) break;
+ }
+
+ json_object_object_add(*jObj_group, "scanner.stats", jArray_stats);
+
+
+}
+#endif
+
+
+
+#ifdef HAVE_JSON_C
/*
* @brief Save Top Stats in json format
*/
-static void saveTopStats(json_object **jObj_group, struct top_stats *stats, int direction, u_int64_t total_ip_addr){
+static void saveTopStats(json_object **jObj_group,
+ struct top_stats *stats,
+ int direction,
+ u_int64_t total_flow_count,
+ u_int64_t total_ip_addr){
+
struct top_stats *s, *tmp;
json_object *jArray_stats = json_object_new_array();
int i = 0;
@@ -1336,8 +1485,12 @@ static void saveTopStats(json_object **jObj_group, struct top_stats *stats, int
json_object *jObj_stat = json_object_new_object();
json_object_object_add(jObj_stat,"port",json_object_new_int(s->port));
json_object_object_add(jObj_stat,"packets.number",json_object_new_int64(s->num_pkts));
- json_object_object_add(jObj_stat,"packets.percent",json_object_new_double(s->prcnt_pkt));
json_object_object_add(jObj_stat,"flows.number",json_object_new_double(s->num_flows));
+ json_object_object_add(jObj_stat,"flows.percent",json_object_new_double((s->num_flows*100.0)/total_flow_count));
+ if(s->num_pkts) json_object_object_add(jObj_stat,"flows/packets",
+ json_object_new_double(((double)s->num_flows)/s->num_pkts));
+ else json_object_object_add(jObj_stat,"flows.num_packets",json_object_new_double(0.0));
+
json_object_object_add(jObj_stat,"aggressive.ip",json_object_new_string(s->top_ip));
json_object_object_add(jObj_stat,"protocol",json_object_new_string(s->proto));
@@ -1665,10 +1818,19 @@ static void printResults(u_int64_t tot_usec) {
}
+ if(verbose == 3) {
+ printf("\n\nSource Ports Stats:\n");
+ printPortStats(srcStats);
+
+ printf("\nDestination Ports Stats:\n");
+ printPortStats(dstStats);
+ }
+
+
if(stats_flag) {
#ifdef HAVE_JSON_C
- u_int64_t total_src_addr = getTopStats(&topSrcStats, srcStats, cumulative_stats.ip_packet_count);
- u_int64_t total_dst_addr = getTopStats(&topDstStats, dstStats, cumulative_stats.ip_packet_count);
+ u_int64_t total_src_addr = getTopStats(&topSrcStats, srcStats);
+ u_int64_t total_dst_addr = getTopStats(&topDstStats, dstStats);
json_object *jObj_stats = json_object_new_object();
char timestamp[64];
@@ -1676,27 +1838,28 @@ static void printResults(u_int64_t tot_usec) {
strftime(timestamp, sizeof(timestamp), "%FT%TZ", localtime(&pcap_start.tv_sec));
json_object_object_add(jObj_stats, "time", json_object_new_string(timestamp));
- saveTopStats(&jObj_stats, topSrcStats, DIR_SRC, total_src_addr);
- saveTopStats(&jObj_stats, topDstStats, DIR_DST, total_dst_addr);
+ saveScannerStats(&jObj_stats, scannerHosts);
+
+ saveTopStats(&jObj_stats, topSrcStats, DIR_SRC, cumulative_stats.ndpi_flow_count, total_src_addr);
+ saveTopStats(&jObj_stats, topDstStats, DIR_DST, cumulative_stats.ndpi_flow_count, total_dst_addr);
json_object_array_add(jArray_topStats, jObj_stats);
deleteTopStats(topSrcStats), deleteTopStats(topDstStats);
topSrcStats = NULL, topDstStats = NULL;
+
+ deleteScanners(scannerHosts);
+ scannerHosts = NULL;
+
#endif
}
+ if(verbose == 3 || stats_flag){
+ deletePortsStats(srcStats), deletePortsStats(dstStats);
+ srcStats = NULL, dstStats = NULL;
+ }
- if(verbose == 3) {
- printf("\n\nSource Ports Stats:\n");
- printPortStats(srcStats);
-
- printf("\nDestination Ports Stats:\n");
- printPortStats(dstStats);
- deletePortsStats(srcStats), deletePortsStats(dstStats);
- srcStats = NULL, dstStats = NULL;
- }
}
diff --git a/src/include/ndpi_protocol_ids.h b/src/include/ndpi_protocol_ids.h
index c32613777..1e088ceaa 100644
--- a/src/include/ndpi_protocol_ids.h
+++ b/src/include/ndpi_protocol_ids.h
@@ -255,25 +255,24 @@
#define NDPI_PROTOCOL_TEREDO 214
#define NDPI_PROTOCOL_HOTSPOT_SHIELD 215
#define NDPI_PROTOCOL_HEP 216 /* sipcapture.org QXIP BV */
-
#define NDPI_PROTOCOL_GOOGLE_DRIVE 217
-
#define NDPI_PROTOCOL_OCS 218
#define NDPI_PROTOCOL_OFFICE_365 219
#define NDPI_PROTOCOL_CLOUDFLARE 220
#define NDPI_PROTOCOL_MS_ONE_DRIVE 221
#define NDPI_PROTOCOL_MQTT 222
#define NDPI_PROTOCOL_RX 223
-
-/* 224 is free */
-#define NDPI_PROTOCOL_FREE_224 224
-
+#define NDPI_PROTOCOL_APPLESTORE 224
#define NDPI_PROTOCOL_OPENDNS 225
#define NDPI_PROTOCOL_GIT 226
#define NDPI_PROTOCOL_DRDA 227
+#define NDPI_PROTOCOL_PLAYSTORE 228 /* Google Play Store */
+
+#define NDPI_PROTOCOL_SOMEIP 229
+
/* UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE UPDATE */
-#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_DRDA
+#define NDPI_LAST_IMPLEMENTED_PROTOCOL NDPI_PROTOCOL_SOMEIP
#define NDPI_MAX_SUPPORTED_PROTOCOLS (NDPI_LAST_IMPLEMENTED_PROTOCOL + 1)
#define NDPI_MAX_NUM_CUSTOM_PROTOCOLS (NDPI_NUM_BITS-NDPI_LAST_IMPLEMENTED_PROTOCOL)
diff --git a/src/include/ndpi_protocols.h b/src/include/ndpi_protocols.h
index f1d34f75e..2ac9485ab 100644
--- a/src/include/ndpi_protocols.h
+++ b/src/include/ndpi_protocols.h
@@ -190,6 +190,7 @@ void ndpi_search_starcraft(struct ndpi_detection_module_struct *ndpi_struct, str
void ndpi_search_ubntac2(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_coap(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_mqtt (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
+void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_rx(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_git(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
void ndpi_search_drda(struct ndpi_detection_module_struct *ndpi_struct, struct ndpi_flow_struct *flow);
@@ -332,6 +333,7 @@ void init_stracraft_dissector(struct ndpi_detection_module_struct *ndpi_struct,
void init_ubntac2_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_coap_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_mqtt_dissector (struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
+void init_someip_dissector (struct ndpi_detection_module_struct *ndpi_struct,u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_rx_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_git_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
void init_hangout_dissector(struct ndpi_detection_module_struct *ndpi_struct, u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask);
diff --git a/src/include/ndpi_typedefs.h b/src/include/ndpi_typedefs.h
index 0bede5cb2..c10101d42 100644
--- a/src/include/ndpi_typedefs.h
+++ b/src/include/ndpi_typedefs.h
@@ -762,6 +762,7 @@ typedef enum {
NDPI_PROTOCOL_CATEGORY_RPC, /* High level network communication protocols */
NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, /* Network administration and monitor protocols */
NDPI_PROTOCOL_CATEGORY_SYSTEM, /* System level applications */
+ NDPI_PROTOCOL_CATEGORY_SW_UPDATE, /* Software update */
NDPI_PROTOCOL_NUM_CATEGORIES /*
NOTE: Keep this as last member
diff --git a/src/lib/Makefile.am b/src/lib/Makefile.am
index 375e9ce48..3af5881b7 100644
--- a/src/lib/Makefile.am
+++ b/src/lib/Makefile.am
@@ -158,6 +158,7 @@ libndpi_la_SOURCES = ndpi_content_match.c.inc \
protocols/zeromq.c \
protocols/smpp.c \
protocols/tinc.c \
+ protocols/SOMEIP.c \
third_party/include/actypes.h \
third_party/include/ahocorasick.h \
third_party/include/ndpi_patricia.h \
diff --git a/src/lib/ndpi_content_match.c.inc b/src/lib/ndpi_content_match.c.inc
index 077a04ff0..528bf84a5 100644
--- a/src/lib/ndpi_content_match.c.inc
+++ b/src/lib/ndpi_content_match.c.inc
@@ -91,7 +91,7 @@ static ndpi_network host_protocol_list[] = {
{ 0xC60BFB20 /* 198.11.251.32/27 */, 27, NDPI_PROTOCOL_WHATSAPP },
{ 0xD02B73C0 /* 208.43.115.192/27 */, 27, NDPI_PROTOCOL_WHATSAPP },
{ 0xD02B7A80 /* 208.43.122.128/27 */, 27, NDPI_PROTOCOL_WHATSAPP },
-
+
/*
WeChat
@@ -859,7 +859,7 @@ static ndpi_network host_protocol_list[] = {
{ 0xAC100010 /* 172.16.0.16/32 */, 32, NDPI_PROTOCOL_BITTORRENT },
{ 0xB2A4F550 /* 178.164.245.80/32 */, 32, NDPI_PROTOCOL_BITTORRENT },
{ 0xAE597B3E /* 174.89.123.62/32 */, 32, NDPI_PROTOCOL_BITTORRENT },
-
+
/*
Tor
@@ -7983,7 +7983,16 @@ ndpi_protocol_match host_match[] = {
{ ".apple.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".mzstatic.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".aaplimg.com", "Apple", NDPI_PROTOCOL_APPLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".icloud.com", "AppleiCloud", NDPI_PROTOCOL_APPLE_ICLOUD, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
+ { "iosapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE }, /* iOS */
+ { "osxapps.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE }, /* MacOS */
+ { "buy.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "su.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "se.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "myapp.itunes.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "swscan.apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "itunes-apple.com", "AppleStore", NDPI_PROTOCOL_APPLESTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
{ "itunes.apple.com", "AppleiTunes", NDPI_PROTOCOL_APPLE_ITUNES, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_FUN },
{ ".cnn.c", "CNN", NDPI_PROTOCOL_CNN, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_FUN },
@@ -8013,6 +8022,9 @@ ndpi_protocol_match host_match[] = {
{ ".docs.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, NDPI_PROTOCOL_SAFE },
{ "drive.", "GoogleDrive", NDPI_PROTOCOL_GOOGLE_DRIVE, NDPI_PROTOCOL_CATEGORY_NETWORK_TOOL, NDPI_PROTOCOL_SAFE },
+ { "android.clients.google.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { "ggpht.com", "PlayStore", NDPI_PROTOCOL_PLAYSTORE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+
{ "google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".google.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ ".gstatic.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
@@ -8025,7 +8037,6 @@ ndpi_protocol_match host_match[] = {
{ "googleusercontent.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "googleadservices.", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "googleapis.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
- { "ggpht.com", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "1e100.net", "Google", NDPI_PROTOCOL_GOOGLE, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
{ "maps.google.", "GoogleMaps", NDPI_PROTOCOL_GOOGLE_MAPS, NDPI_PROTOCOL_CATEGORY_WEB, NDPI_PROTOCOL_ACCEPTABLE },
@@ -8089,7 +8100,7 @@ ndpi_protocol_match host_match[] = {
{ ".spotify.", "Spotify", NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN },
{ "audio-fa.scdn.co", "Spotify", NDPI_PROTOCOL_SPOTIFY, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN },
-
+
{ ".pandora.com", "Pandora", NDPI_PROTOCOL_PANDORA, NDPI_PROTOCOL_CATEGORY_MEDIA, NDPI_PROTOCOL_FUN },
@@ -8144,8 +8155,8 @@ ndpi_protocol_match host_match[] = {
{ "skyapi.live.net", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE },
{ "d.docs.live.net", "MS_OneDrive", NDPI_PROTOCOL_MS_ONE_DRIVE, NDPI_PROTOCOL_CATEGORY_CLOUD, NDPI_PROTOCOL_ACCEPTABLE },
- { "update.microsoft.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SYSTEM, NDPI_PROTOCOL_ACCEPTABLE },
- { ".windowsupdate.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SYSTEM, NDPI_PROTOCOL_ACCEPTABLE },
+ { "update.microsoft.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
+ { ".windowsupdate.com", "WindowsUpdate", NDPI_PROTOCOL_WINDOWS_UPDATE, NDPI_PROTOCOL_CATEGORY_SW_UPDATE, NDPI_PROTOCOL_ACCEPTABLE },
{ "worldofwarcraft.com", "WorldOfWarcraft", NDPI_PROTOCOL_WORLDOFWARCRAFT, NDPI_PROTOCOL_CATEGORY_GAME, NDPI_PROTOCOL_FUN },
@@ -8301,7 +8312,7 @@ ndpi_protocol_match content_match[] = {
- www.fgd2iwya7vinfutj5wq5we.net
See also DGA (Domain Generation Algorithm)
-
+
In essence www.<name>.com|net
To do things properly we should check if host name in the certificate
diff --git a/src/lib/ndpi_main.c b/src/lib/ndpi_main.c
index 9c6432de0..8ff3855af 100644
--- a/src/lib/ndpi_main.c
+++ b/src/lib/ndpi_main.c
@@ -1571,6 +1571,11 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
no_master, "MQTT", NDPI_PROTOCOL_CATEGORY_RPC,
ndpi_build_default_ports(ports_a, 1883, 8883, 0, 0, 0), /* TCP */
ndpi_build_default_ports(ports_b, 0, 0, 0, 0, 0)); /* UDP */
+ ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_SOMEIP,
+ no_master,
+ no_master, "SOME/IP", NDPI_PROTOCOL_CATEGORY_RPC,
+ ndpi_build_default_ports(ports_a, 30491, 30501, 0, 0, 0), /* TCP */
+ ndpi_build_default_ports(ports_b, 30491, 30501, 30490, 0, 0)); /* UDP */
ndpi_set_proto_defaults(ndpi_mod, NDPI_PROTOCOL_ACCEPTABLE, NDPI_PROTOCOL_RX,
no_master,
no_master, "RX", NDPI_PROTOCOL_CATEGORY_RPC,
@@ -1622,9 +1627,6 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
ndpi_build_default_ports(ports_a, 655, 0, 0, 0, 0) /* TCP */,
ndpi_build_default_ports(ports_b, 655, 0, 0, 0, 0) /* UDP */);
-/* To be removed as soon as we define new protocols */
- ndpi_init_placeholder_proto(ndpi_mod, ports_a, ports_b, no_master, NDPI_PROTOCOL_FREE_224);
-
/* calling function for host and content matched protocols */
init_string_based_protocols(ndpi_mod);
@@ -1640,11 +1642,14 @@ static void ndpi_init_protocol_defaults(struct ndpi_detection_module_struct *ndp
static int ac_match_handler(AC_MATCH_t *m, void *param) {
int *matching_protocol_id = (int*)param;
- /* Stopping to the first match. We might consider searching
- * for the more specific match, paying more cpu cycles. */
+ /*
+ Return 1 for stopping to the first match.
+ We might consider searching for the more
+ specific match, paying more cpu cycles.
+ */
*matching_protocol_id = m->patterns[0].rep.number;
- return 1; /* 0 to continue searching, !0 to stop */
+ return 0; /* 0 to continue searching, !0 to stop */
}
/* ******************************************************************** */
@@ -2691,6 +2696,9 @@ void ndpi_set_protocol_detection_bitmask2(struct ndpi_detection_module_struct *n
/* MQTT */
init_mqtt_dissector(ndpi_struct, &a, detection_bitmask);
+ /* SOME/IP */
+ init_someip_dissector(ndpi_struct, &a, detection_bitmask);
+
/* RX */
init_rx_dissector(ndpi_struct, &a, detection_bitmask);
@@ -4493,6 +4501,9 @@ const char* ndpi_category_str(ndpi_protocol_category_t category) {
case NDPI_PROTOCOL_CATEGORY_UNSPECIFIED:
return("Unspecified");
break;
+ case NDPI_PROTOCOL_CATEGORY_SW_UPDATE:
+ return("SoftwareUpdate");
+ break;
case NDPI_PROTOCOL_NUM_CATEGORIES:
return("Code should not use this internal constant");
break;
@@ -4615,9 +4626,9 @@ char* ndpi_strnstr(const char *s, const char *find, size_t slen) {
int ndpi_match_prefix(const u_int8_t *payload, size_t payload_len,
const char *str, size_t str_len)
{
- return str_len <= payload_len
- ? memcmp(payload, str, str_len) == 0
- : 0;
+ int rc = str_len <= payload_len ? memcmp(payload, str, str_len) == 0 : 0;
+
+ return rc;
}
/* ****************************************************** */
@@ -4628,7 +4639,8 @@ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_stru
int matching_protocol_id = NDPI_PROTOCOL_UNKNOWN;
AC_TEXT_t ac_input_text;
ndpi_automa *automa = is_host_match ? &ndpi_struct->host_automa : &ndpi_struct->content_automa;
-
+ int rc;
+
if((automa->ac_automa == NULL) || (string_to_match_len == 0)) return(NDPI_PROTOCOL_UNKNOWN);
if(!automa->ac_automa_finalized) {
@@ -4638,6 +4650,7 @@ int ndpi_match_string_subprotocol(struct ndpi_detection_module_struct *ndpi_stru
ac_input_text.astring = string_to_match, ac_input_text.length = string_to_match_len;
ac_automata_search(((AC_AUTOMATA_t*)automa->ac_automa), &ac_input_text, (void*)&matching_protocol_id);
+
ac_automata_reset(((AC_AUTOMATA_t*)automa->ac_automa));
return(matching_protocol_id);
diff --git a/src/lib/protocols/SOMEIP.c b/src/lib/protocols/SOMEIP.c
new file mode 100644
index 000000000..adffb0c33
--- /dev/null
+++ b/src/lib/protocols/SOMEIP.c
@@ -0,0 +1,223 @@
+/*
+ * SOMEIP.c
+ *
+ * Copyright (C) 2016 Sorin Zamfir <sorin.zamfir@yahoo.com>
+ *
+ * This file is part of nDPI, an open source deep packet inspection
+ * library based on the OpenDPI and PACE technology by ipoque GmbH
+ *
+ * nDPI is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your omessage_typeion) any later version.
+ *
+ * nDPI is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with nDPI. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+
+#include "ndpi_protocols.h"
+#ifdef NDPI_PROTOCOL_SOMEIP
+
+enum SOMEIP_MESSAGE_TYPES {
+ REQUEST = 0x00,
+ REQUEST_NO_RETURN = 0x01,
+ NOTIFICATION = 0x02,
+ REQUEST_ACK = 0x40,
+ REQUEST_NO_RETURN_ACK = 0x41,
+ NOTIFICATION_ACK = 0x42,
+ RESPONSE = 0x80,
+ ERROR = 0x81,
+ RESPONSE_ACK = 0xc0,
+ ERROR_ACK = 0xc1
+};
+
+enum SOMEIP_RETURN_CODES {
+ E_OK = 0x00,
+ E_NOT_OK = 0x01,
+ E_UNKNOWN_SERVICE = 0x02,
+ E_UNKNOWN_METHOD = 0x03,
+ E_NOT_READY = 0x04,
+ E_NOT_REACHABLE = 0x05,
+ E_TIMEOUT = 0x06,
+ E_WRONG_PROTOCOL_VERSION = 0x07,
+ E_WRONG_INTERFACE_VERSION = 0x08,
+ E_MALFORMED_MESSAGE = 0x09,
+ E_WRONG_MESSAGE_TYPE = 0x0a,
+ E_RETURN_CODE_LEGAL_THRESHOLD = 0x40 //return codes from 0x40 (inclusive) and upwards are illegal.
+};
+
+enum SPECIAL_MESSAGE_IDS {
+ MSG_MAGIC_COOKIE = 0xffff0000,
+ MSG_MAGIC_COOKIE_ACK = 0xffff8000,
+ MSG_SD = 0xffff8100
+};
+
+enum PROTOCOL_VERSION{
+ LEGAL_PROTOCOL_VERSION = 0x01
+};
+
+enum MAGIC_COOKIE_CONSTANTS{
+ MC_REQUEST_ID = 0xDEADBEEF,
+ MC_LENGTH = 0x08,
+ MC_INTERFACE_VERSION = 0x01
+};
+
+enum DEFAULT_PROTOCOL_PORTS{
+ PORT_DEFAULT_CLIENT = 30491,
+ PORT_DEFAULT_SERVER = 30501,
+ PORT_DEFAULT_SD = 30490
+};
+
+/**
+ * Entry point when protocol is identified.
+ */
+static void ndpi_int_someip_add_connection (struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+ ndpi_set_detected_protocol(ndpi_struct,flow,NDPI_PROTOCOL_SOMEIP,NDPI_PROTOCOL_UNKNOWN);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found.\n");
+}
+
+/**
+ * Dissector function that searches SOME/IP headers
+ */
+void ndpi_search_someip (struct ndpi_detection_module_struct *ndpi_struct,
+ struct ndpi_flow_struct *flow)
+{
+
+ //####Maybe check carrier protocols?####
+
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP search called...\n");
+ const struct ndpi_packet_struct *packet = &flow->packet;
+ if (packet->detected_protocol_stack[0] != NDPI_PROTOCOL_UNKNOWN) {
+ return;
+ }
+
+ //we extract the Message ID and Request ID and check for special cases later
+ u_int32_t message_id = ntohl(*((u_int32_t *)&packet->payload[0]));
+ u_int32_t request_id = ntohl(*((u_int32_t *)&packet->payload[8]));
+
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "====>>>> SOME/IP Message ID: %08x [len: %u]\n",
+ message_id, packet->payload_packet_len);
+ if (packet->payload_packet_len < 16) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. mandatory header not found (not enough data for all fields)\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ //####Maximum packet size in SOMEIP depends on the carrier protocol, and I'm not certain how well enforced it is, so let's leave that for round 2####
+
+ // we extract the remaining length
+ u_int32_t someip_len = ntohl(*((u_int32_t *)&packet->payload[4]));
+ if (packet->payload_packet_len != (someip_len + 8)) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. Length field invalid!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ u_int8_t protocol_version = (u_int8_t) (packet->payload[12]);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP protocol version: [%d]\n",protocol_version);
+ if (protocol_version != LEGAL_PROTOCOL_VERSION){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid protocol version!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ u_int8_t interface_version = (packet->payload[13]);
+
+ u_int8_t message_type = (u_int8_t) (packet->payload[14]);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP message type: [%d]\n",message_type);
+
+ if ((message_type != REQUEST) && (message_type != REQUEST_NO_RETURN) && (message_type != NOTIFICATION) && (message_type != REQUEST_ACK) &&
+ (message_type != REQUEST_NO_RETURN_ACK) && (message_type != NOTIFICATION_ACK) && (message_type != RESPONSE) &&
+ (message_type != ERROR) && (message_type != RESPONSE_ACK) && (message_type != ERROR_ACK)) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid message type!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ u_int8_t return_code = (u_int8_t) (packet->payload[15]);
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG,"====>>>> SOME/IP return code: [%d]\n", return_code);
+ if ((return_code >= E_RETURN_CODE_LEGAL_THRESHOLD)) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP .. invalid return code!\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+
+ if (message_id == MSG_MAGIC_COOKIE){
+ if ((someip_len == MC_LENGTH) && (request_id == MC_REQUEST_ID) && (interface_version == MC_INTERFACE_VERSION) &&
+ (message_type == REQUEST_NO_RETURN) && (return_code == E_OK)){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found Magic Cookie\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ else{
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP, invalid header for Magic Cookie\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+ }
+
+ if (message_id == MSG_MAGIC_COOKIE_ACK){
+ if ((someip_len == MC_LENGTH) && (request_id == MC_REQUEST_ID) && (interface_version == MC_INTERFACE_VERSION) &&
+ (message_type == REQUEST_NO_RETURN) && (return_code == E_OK)){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found Magic Cookie ACK\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ else{
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Excluding SOME/IP, invalid header for Magic Cookie ACK\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+ }
+ }
+
+ if (message_id == MSG_SD){
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP-SD currently not supported\n", message_type);
+ }
+
+ //Filtering by port.
+ //This check is NOT a 100% thing - these ports are mentioned in the documentation but the documentation also states they haven't been approved by IANA yet, and that the user is free to use different ports.
+ //This is is PURELY for demo purposes and the rest of the check must be filled in later on!
+ if (packet->l4_protocol == IPPROTO_UDP){
+ if ((packet->udp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SERVER)) || (packet->udp->dest == ntohs(PORT_DEFAULT_SD))) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ }
+ if (packet->l4_protocol == IPPROTO_TCP){
+ if ((packet->tcp->dest == ntohs(PORT_DEFAULT_CLIENT)) || (packet->tcp->dest == ntohs(PORT_DEFAULT_SERVER))) {
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP found\n",message_type);
+ ndpi_int_someip_add_connection(ndpi_struct, flow);
+ return;
+ }
+ }
+
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "Reached the end without confirming SOME/IP ...\n");
+ NDPI_ADD_PROTOCOL_TO_BITMASK(flow->excluded_protocol_bitmask, NDPI_PROTOCOL_SOMEIP);
+ return;
+}
+/**
+ * Entry point for the ndpi library
+ */
+void init_someip_dissector (struct ndpi_detection_module_struct *ndpi_struct,
+ u_int32_t *id, NDPI_PROTOCOL_BITMASK *detection_bitmask)
+{
+ NDPI_LOG(NDPI_PROTOCOL_SOMEIP, ndpi_struct, NDPI_LOG_DEBUG, "SOME/IP dissector init...\n");
+ ndpi_set_bitmask_protocol_detection ("SOME/IP", ndpi_struct, detection_bitmask, *id,
+ NDPI_PROTOCOL_SOMEIP,
+ ndpi_search_someip,
+ NDPI_SELECTION_BITMASK_PROTOCOL_V4_V6_TCP_OR_UDP_WITH_PAYLOAD,
+ SAVE_DETECTION_BITMASK_AS_UNKNOWN, ADD_TO_DETECTION_BITMASK);
+ *id +=1;
+}
+
+#endif // NDPI_PROTOCOL_SOMEIP
+
diff --git a/src/lib/protocols/mdns.c b/src/lib/protocols/mdns.c
index 0692b3252..d805a0bca 100644
--- a/src/lib/protocols/mdns.c
+++ b/src/lib/protocols/mdns.c
@@ -1,7 +1,7 @@
/*
* mdns.c
*
- * Copyright (C) 2016 - ntop.org
+ * Copyright (C) 2016-17 - ntop.org
*
* This file is part of nDPI, an open source deep packet inspection
* library based on the OpenDPI and PACE technology by ipoque GmbH
@@ -26,6 +26,10 @@
#define NDPI_MAX_MDNS_REQUESTS 128
+PACK_ON
+struct mdns_header {
+ u_int16_t transaction_id, flags, questions, answers, authority_rr, additional_rr;
+} PACK_OFF;
/**
MDNS header is similar to dns header
@@ -48,27 +52,26 @@
static void ndpi_int_mdns_add_connection(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+ *ndpi_struct, struct ndpi_flow_struct *flow) {
ndpi_set_detected_protocol(ndpi_struct, flow, NDPI_PROTOCOL_MDNS, NDPI_PROTOCOL_UNKNOWN);
}
static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
- *ndpi_struct, struct ndpi_flow_struct *flow)
-{
+ *ndpi_struct, struct ndpi_flow_struct *flow) {
struct ndpi_packet_struct *packet = &flow->packet;
-
- if((packet->payload[2] & 0x80) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS) {
-
+ struct mdns_header *h = (struct mdns_header*)packet->payload;
+ u_int16_t questions = ntohs(h->questions), answers = ntohs(h->answers);
+
+ if(((packet->payload[2] & 0x80) == 0)
+ && (questions <= NDPI_MAX_MDNS_REQUESTS)
+ && (answers <= NDPI_MAX_MDNS_REQUESTS)) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct, NDPI_LOG_DEBUG, "found MDNS with question query.\n");
return 1;
}
- else if((packet->payload[2] & 0x80) != 0 &&
- ntohs(get_u_int16_t(packet->payload, 4)) == 0 &&
- ntohs(get_u_int16_t(packet->payload, 6)) <= NDPI_MAX_MDNS_REQUESTS &&
- ntohs(get_u_int16_t(packet->payload, 6)) != 0) {
+ else if(((packet->payload[2] & 0x80) != 0)
+ && (questions == 0)
+ && (answers <= NDPI_MAX_MDNS_REQUESTS)
+ && (answers != 0)) {
char answer[256];
int i, j, len;
@@ -77,7 +80,7 @@ static int ndpi_int_check_mdns_payload(struct ndpi_detection_module_struct
answer[j] = '\0';
- /* printf("==> [%d] %s\n", j, answer); */
+ /* printf("==> [%d] %s\n", j, answer); */
len = ndpi_min(sizeof(flow->protos.mdns.answer)-1, j);
strncpy(flow->protos.mdns.answer, (const char *)answer, len);
@@ -107,7 +110,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
/* check standard MDNS ON port 5353 */
if(dport == 5353 && packet->payload_packet_len >= 12) {
/* mdns protocol must have destination address 224.0.0.251 */
- if(packet->iph != NULL && ntohl(packet->iph->daddr) == 0xe00000fb) {
+ if(packet->iph != NULL /* && ntohl(packet->iph->daddr) == 0xe00000fb */) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
NDPI_LOG_DEBUG, "found MDNS with destination address 224.0.0.251 (=0xe00000fb)\n");
@@ -120,7 +123,7 @@ void ndpi_search_mdns(struct ndpi_detection_module_struct *ndpi_struct, struct n
#ifdef NDPI_DETECTION_SUPPORT_IPV6
if(packet->iphv6 != NULL) {
const u_int32_t *daddr = packet->iphv6->ip6_dst.u6_addr.u6_addr32;
- if(daddr[0] == htonl(0xff020000) && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb)) {
+ if(daddr[0] == htonl(0xff020000) /* && daddr[1] == 0 && daddr[2] == 0 && daddr[3] == htonl(0xfb) */) {
NDPI_LOG(NDPI_PROTOCOL_MDNS, ndpi_struct,
NDPI_LOG_DEBUG, "found MDNS with destination address ff02::fb\n");
diff --git a/wireshark/ndpi.lua b/wireshark/ndpi.lua
index f9db38411..495d4c14c 100644
--- a/wireshark/ndpi.lua
+++ b/wireshark/ndpi.lua
@@ -48,6 +48,9 @@ local f_ip_len = Field.new("ip.len")
local f_ip_hdr_len = Field.new("ip.hdr_len")
local f_ssl_server_name = Field.new("ssl.handshake.extensions_server_name")
local f_tcp_flags = Field.new('tcp.flags')
+local f_tcp_retrans = Field.new('tcp.analysis.retransmission')
+local f_tcp_ooo = Field.new('tcp.analysis.out_of_order')
+local f_tcp_lost_segment = Field.new('tcp.analysis.lost_segment') -- packet drop ?
local ndpi_protos = {}
local ndpi_flows = {}
@@ -295,6 +298,14 @@ function ndpi_proto.init()
top_dns_queries = {}
num_top_dns_queries = 0
+ -- TCP analysis
+ num_tcp_retrans = 0
+ num_tcp_ooo = 0
+ num_tcp_lost_segment = 0
+ tcp_retrans = {}
+ tcp_ooo = {}
+ tcp_lost_segment = {}
+
-- Network RRT
min_nw_client_RRT = {}
min_nw_server_RRT = {}
@@ -529,6 +540,35 @@ end
-- ###############################################
+function tcp_dissector(tvb, pinfo, tree)
+ local _tcp_retrans = f_tcp_retrans()
+ local _tcp_ooo = f_tcp_ooo()
+ local _tcp_lost_segment = f_tcp_lost_segment()
+
+ if(_tcp_retrans ~= nil) then
+ local key = getstring(pinfo.src)..":"..getstring(pinfo.src_port).." -> "..getstring(pinfo.dst)..":"..getstring(pinfo.dst_port)
+ num_tcp_retrans = num_tcp_retrans + 1
+ if(tcp_retrans[key] == nil) then tcp_retrans[key] = 0 end
+ tcp_retrans[key] = tcp_retrans[key] + 1
+ end
+
+ if(_tcp_ooo ~= nil) then
+ local key = getstring(pinfo.src)..":"..getstring(pinfo.src_port).." -> "..getstring(pinfo.dst)..":"..getstring(pinfo.dst_port)
+ num_tcp_ooo = num_tcp_ooo + 1
+ if(tcp_ooo[key] == nil) then tcp_ooo[key] = 0 end
+ tcp_ooo[key] = tcp_ooo[key] + 1
+ end
+
+ if(_tcp_lost_segment ~= nil) then
+ local key = getstring(pinfo.src)..":"..getstring(pinfo.src_port).." -> "..getstring(pinfo.dst)..":"..getstring(pinfo.dst_port)
+ num_tcp_lost_segment = num_tcp_lost_segment + 1
+ if(tcp_lost_segment[key] == nil) then tcp_lost_segment[key] = 0 end
+ tcp_lost_segment[key] = tcp_lost_segment[key] + 1
+ end
+end
+
+-- ###############################################
+
function latency_dissector(tvb, pinfo, tree)
local _tcp_flags = f_tcp_flags()
local udp_len = f_udp_len()
@@ -743,6 +783,7 @@ function ndpi_proto.dissector(tvb, pinfo, tree)
end -- nDPI
latency_dissector(tvb, pinfo, tree)
+ tcp_dissector(tvb, pinfo, tree)
end
-- ###########################################
@@ -1077,11 +1118,52 @@ end
-- ###############################################
+local function tcp_dialog_menu()
+ local win = TextWindow.new("TCP Packets Analysis");
+ local label = ""
+
+ label = label .. "Total Retransmissions : "..num_tcp_retrans.."\n"
+ if(num_tcp_retrans > 0) then
+ i = 0
+ label = label .. "-----------------------------\n"
+ for k,v in pairsByValues(tcp_retrans, rev) do
+ label = label .. string.format("%-48s", shortenString(k,48)).."\t"..v.."\n"
+ if(i == 10) then break else i = i + 1 end
+ end
+ end
+
+ label = label .. "\nTotal Out-of-Order : "..num_tcp_ooo.."\n"
+ if(num_tcp_ooo > 0) then
+ i = 0
+ label = label .. "-----------------------------\n"
+ for k,v in pairsByValues(tcp_ooo, rev) do
+ label = label .. string.format("%-48s", shortenString(k,48)).."\t"..v.."\n"
+ if(i == 10) then break else i = i + 1 end
+ end
+ end
+
+ label = label .. "\nTotal Lost Segment : "..num_tcp_lost_segment.."\n"
+ if(num_tcp_lost_segment > 0) then
+ i = 0
+ label = label .. "-----------------------------\n"
+ for k,v in pairsByValues(tcp_lost_segment, rev) do
+ label = label .. string.format("%-48s", shortenString(k,48)).."\t"..v.."\n"
+ if(i == 10) then break else i = i + 1 end
+ end
+ end
+
+ win:set(label)
+ win:add_button("Clear", function() win:clear() end)
+end
+
+-- ###############################################
+
register_menu("ntop/ARP", arp_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/VLAN", vlan_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/IP-MAC", ip_mac_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/DNS", dns_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/SSL", ssl_dialog_menu, MENU_TOOLS_UNSORTED)
+register_menu("ntop/TCP Analysis", tcp_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/Latency/Network", rtt_dialog_menu, MENU_TOOLS_UNSORTED)
register_menu("ntop/Latency/Application", appl_rtt_dialog_menu, MENU_TOOLS_UNSORTED)
Powered by cgit, Themed by Ted Yin.