aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAge
...
* Improved user agent analysisLuca Deri2022-01-09
|
* GTP: fix some false positives (#1394)Ivan Nardi2022-01-08
|
* Remove some unused fields (#1393)Ivan Nardi2022-01-08
|
* Improved bittorrent detectionLuca Deri2022-01-06
|
* Invalid checkLuca Deri2022-01-06
|
* Added missing dependencyLuca Deri2022-01-05
|
* Update issue tempalteAlfredo Cardigliano2022-01-03
|
* Update copyrightAlfredo Cardigliano2022-01-03
|
* Improved BitTorrent guessLuca Deri2021-12-26
|
* Added support for Log4J/Log4Shell detection in nDPI via a new flow risk ↵Luca Deri2021-12-23
| | | | named NDPI_POSSIBLE_EXPLOIT
* Add support for ICloud Private Relay (#1390)Ivan Nardi2021-12-22
| | | | | | | See: https://www.apple.com/privacy/docs/iCloud_Private_Relay_Overview_Dec2021.PDF TODO: an up-to-date list of egress IP ranges is publicly available. Can we use it somehow?
* A final(?) effort to reduce memory usage per flow (#1389)Ivan Nardi2021-12-22
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove some unused fields and re-organize other ones. In particular: * Update the parameters of `ndpi_ssl_version2str()` function * Zattoo, Thunder: these timestamps aren't really used. * Ftp/mail: these protocols are dissected only over TCP. * Attention must be paid to TLS.Bittorrent flows to avoid invalid read/write to `flow->protos.bittorrent.hash` field. This is the last(?) commit of a long series (see 22241a1d, 227e586e, 730c2360, a8ffcd8b) aiming to reduce library memory consumption. Before, at nDPI 4.0 (more precisly, at a6b10cf7, because memory stats were wrong until that commit): ``` nDPI Memory statistics: nDPI Memory (once): 221.15 KB Flow Memory (per flow): 2.94 KB ``` Now: ``` nDPI Memory statistics: nDPI Memory (once): 231.71 KB Flow Memory (per flow): 1008 B <--------- ``` i.e. memory usage per flow has been reduced by 66%, dropping below the psychological threshold of 1 KB. To further reduce this value, we probably need to look into #1279: let's fight this battle another day.
* Add links to other user guidesAlfredo Cardigliano2021-12-22
|
* Improved bittorrent heuristicLuca Deri2021-12-21
|
* Fix a global-buffer-overflow when loading Azure list (#1388)Ivan Nardi2021-12-19
|
* Added Microsoft Azure supportLuca Deri2021-12-19
|
* Improve/add several protocols (#1383)Ivan Nardi2021-12-18
| | | | | | | | | | | | | | | | | | | Improve Microsoft, GMail, Likee, Whatsapp, DisneyPlus and Tiktok detection. Add Vimeo, Fuze, Alibaba and Firebase Crashlytics detection. Try to differentiate between Messenger/Signal standard flows (i.e chat) and their VOIP (video)calls (like we already do for Whatsapp and Snapchat). Add a partial list of some ADS/Tracking stuff. Fix Cassandra, Radius and GTP false positives. Fix DNS, Syslog and SIP false negatives. Improve GTP (sub)classification: differentiate among GTP-U, GTP_C and GTP_PRIME. Fix 3 LGTM warnings.
* TLS: add support for IPV6 in Subject Alt Names field (#1385)Ivan Nardi2021-12-18
|
* TLS: fix usage of certificate cache (#1384)Ivan Nardi2021-12-18
|
* Improved bittorrent detectionLuca Deri2021-12-17
|
* QUIC: fix old versions of GQUIC on big-endian machines (#1387)Ivan Nardi2021-12-17
| | | Credits to @viniciussn (see #1312)
* Improved BitTorrent classificationLuca Deri2021-12-07
|
* Optimized ndpi_serialize_string_int32Luca Deri2021-12-07
|
* Fixed issue that prevented alt certificate names to be fully detected when ↵Luca Deri2021-12-07
| | | | ipAddress and rfc822Name were specified in certificates
* Added missing install targetLuca Deri2021-12-07
|
* Fix configure script (after fb85dac9) (#1381)Ivan Nardi2021-12-04
| | | Fix/disable some LGTM warnings
* Improve IPv6 support, enabling IPv6 traffic on (almost) all dissectors. (#1380)Ivan Nardi2021-12-04
| | | | | | | | | | | There are no valid reasons for a (generic) protocol to ignore IPv6 traffic. Note that: * I have not found the specifications of "CheckPoint High Availability Protocol", so I don't know how/if it supports IPv6 * all LRU caches are still IPv4 only Even if src_id/dst_id stuff is probably useless (see #1279), the right way to update the protocol classification is via `ndpi_set_detected_protocol()`
* QUIC: add support for QUICv2 (draft 00) (#1379)Ivan Nardi2021-12-04
| | | | It is already time to start looking at the new QUIC version. See: https://datatracker.ietf.org/doc/html/draft-ietf-quic-v2-00
* Make serialize risk and proto not dependant on any flow. (#1377)Toni2021-12-04
| | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Configure improvementsLuca Deri2021-12-04
| | | | Fixed invalid anomaly detection in rrd_anomaly
* Added example for finding similarities in RRDs using nDPI statistical APIsLuca Deri2021-12-04
|
* Added quick mode (-q)Luca Deri2021-12-03
|
* Updated rrdtool makefileLuca Deri2021-12-03
|
* Demo tool for finding anomalies in RRD filesLuca Deri2021-12-03
|
* Remove printf when not requiredAlfredo Cardigliano2021-12-01
|
* Improve JSON serializationAlfredo Cardigliano2021-12-01
|
* Improved CSV serializationLuca Deri2021-11-30
|
* Fixed seriealizer unitLuca Deri2021-11-30
|
* Removed spaces from some protocol names as they create problems with some ↵Luca Deri2021-11-30
| | | | applications
* ndpiReader: slight simplificaton of the output (#1378)Ivan Nardi2021-11-27
|
* Added ndpi_serializer_skip_header() serialization APILuca Deri2021-11-26
|
* Added Salesforce detectionLuca Deri2021-11-26
|
* HTTP proxy improvementLuca Deri2021-11-25
|
* Reworked HTTP protocol dissection including HTTP proxy and HTTP connectLuca Deri2021-11-25
|
* Aded default port to HTTP_CONNECTLuca Deri2021-11-25
|
* Added googletagmanager.com to the host_match listLuca Deri2021-11-25
|
* Rework how hostname/SNI info is saved (#1330)Ivan Nardi2021-11-24
| | | | | | | | | | | | | | | | | | | | | | | | | | | Looking at `struct ndpi_flow_struct` the two bigger fields are `host_server_name[240]` (mainly for HTTP hostnames and DNS domains) and `protos.tls_quic.client_requested_server_name[256]` (for TLS/QUIC SNIs). This commit aims to reduce `struct ndpi_flow_struct` size, according to two simple observations: 1) maximum one of these two fields is used for each flow. So it seems safe to merge them; 2) even if hostnames/SNIs might be very long, in practice they are rarely longer than a fews tens of bytes. So, using a (single) large buffer is a waste of memory for all kinds of flows. If we need to truncate the name, we keep the *last* characters, easing domain matching. Analyzing some real traffic, it seems safe to assume that the vast majority of hostnames/SNIs is shorter than 80 bytes. Hostnames/SNIs are always converted to lowercase. Attention was given so as to be sure that unit-tests outputs are not affected by this change. Because of a bug, TLS/QUIC SNI were always truncated to 64 bytes (the *first* 64 ones): as a consequence, there were some "Suspicious DGA domain name" and "TLS Certificate Mismatch" false positives.
* QUIC: fix extra dissection (#1376)Ivan Nardi2021-11-23
| | | | When we have fully reassembled the Client Hello, we need to stop extra dissection.
* BitTorrent dissector code cleanup and merge of ↵Luca Deri2021-11-17
| | | | https://github.com/ntop/nDPI/pull/1374
* BitTorrent detection improvementsLuca Deri2021-11-17
|
Powered by cgit, Themed by Ted Yin.