aboutsummaryrefslogtreecommitdiff
path: root/examples
Commit message (Collapse)AuthorAge
...
* Added https://gitlab.com/verzulli/ndpid-rt-analyzer.git to examples.Toni Uhlig2022-09-06
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Disable timestamp generation in nDPIsrvd-collectd as default.Toni Uhlig2022-09-04
| | | | | | * collectd's rrdtool write plugin does silently fail with those ones (dunno why) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Split `*_l4_payload_len' into `*_src_l4_payload_len' and `*_dst_l4_payload_len'.Toni Uhlig2022-08-15
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* c-collectd: fixed incorrect PUTVALToni Uhlig2022-08-15
| | | | | | * get rid of types.db Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improve READMEDamiano Verzulli2022-08-12
| | | | | | | | - slightly improve the README to better enhance the streaming capability of `nDPId`, regardless of `nDPIsrvd` - add a screencast showing the install step and the `nDPId` usage, alone (with ncat as unix-socket listener) - add "build" to .gitignore
* c-collectd: fixed possible undefined behaviorToni Uhlig2022-07-14
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* README updateToni Uhlig2022-07-12
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* py-flow-dashboard: Improved graph axis scaling.lns2022-06-16
| | | | Signed-off-by: lns <matzeton@googlemail.com>
* CMake: do not add /usr/include/ndpi to include dirs if BUILD_NDPI or ↵lns2022-06-10
| | | | | | | | | STATIC_LIBNDPI_INSTALLDIR used. * c-collectd: fixed memory leak on failure * py-flow-info.py: fancy spinners and stats counting improved Signed-off-by: lns <matzeton@googlemail.com>
* Merge branch 'master' of github.com:lnslbrty/nDPIdToni Uhlig2022-06-07
|\
| * README updatelns2022-05-31
| | | | | | | | Signed-off-by: lns <matzeton@googlemail.com>
* | nDPIsrvd.py: Throw SocketTimeout Exception to catch both timeout exceptions ↵Toni Uhlig2022-06-07
|/ | | | | | different Python versions can throw. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Small fixes.lns2022-04-26
| | | | Signed-off-by: lns <matzeton@googlemail.com>
* Added proper DLT_RAW dissection for IPv4 and IPv6.lns2022-04-24
| | | | | | | | | | * nDPId: Improved TCP timeout handling if FIN/RST seen which caused Midstream TCP flows when there shouldn't be any. * nDPIsrvd: Unified remote descriptor resource cleanup on disconnects/shutdown. * nDPIsrvd: Added additional error messages for remote descriptors. * py-flow-info: Better daemon status message printing. Signed-off-by: lns <matzeton@googlemail.com>
* nDPIsrvd.(h|py): Added socket read/recv timeout.lns2022-04-17
| | | | | | * nDPIsrvd.h: support for O_NONBLOCK nDPIsrvd_socket Signed-off-by: lns <matzeton@googlemail.com>
* Executing ./tests/run_tests.sh w/o zLib should not result in diff's anymore.Toni Uhlig2022-03-24
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Reworked nDPIsrvd.h C-API.Toni Uhlig2022-03-21
| | | | | | | | | | | | * nDPIsrvd.h: Provide nDPId thread storage. * nDPIsrvd.py: Fixed instance cleanup bug. * nDPIsrvd.h: Support for instance/thread user data and cleanup callback. * nDPIsrvd.h: Most recent flow time stored in thread ht instead of instance ht. * nDPId: Moved flow logger out the memory profilier into SIGUSR1 signal handling. * nDPId: Added signal fd to be usable within epoll's event handling (live-capture only!) * nDPId: Added information about ZLib compressions to daemon status/shutdown events. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Renamed basic event to error event for the sake of the logic.Toni Uhlig2022-03-13
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Disconnect nDPIsrvd clients immediately instead waiting for a failed write().Toni Uhlig2022-03-13
| | | | | | | | | * nDPIsrvd: Collector/Distributor logging improved * nDPIsrvd: Command line option for max remote descriptors * nDPId: Stop spamming nDPIsrvd Collector with the same events over and over again * nDPId: Refactored some variable names and events Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fixed some pyhton issues with static class members.Toni Uhlig2022-03-08
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Updated examples/README.mdToni Uhlig2022-03-06
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Removed go-dashboard example.Toni Uhlig2022-03-06
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added daemon event: DAEMON_EVENT_STATUS (periodically send's daemon statistics.)Toni Uhlig2022-03-06
| | | | | | | | | | * Improved distributor timeout handling (per-thread). * flow-info.py / flow-dash.py: Distinguish between flow risk severities. * nDPId: Skip tag switch datalink packet dissection / processing. * nDPId: Fixed incorrect value for current active flows. * Improved JSON schema's. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Serialize flow risk score / confidence.Toni Uhlig2022-02-27
| | | | | | | * bump libnDPI to 8b062295cc76a60e3905c054ce37bd17669464d1 * removed ndpi_id_struct's Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved py-flow-info to provide more optional information about received ↵Toni Uhlig2022-02-05
| | | | | | | | | | timestamps. * py-flow-dashboard: Added color mapping for PieCharts/Graph that make more sense * nDPId: Renamed `flow_type' to a more precisely `flow_state' * nDPId: Changed the default setting to process only as much packets as libnDPI does Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added additional (minimalistic) detection information to flow updates.Toni Uhlig2022-02-04
| | | | | | | | | | | | | This will only affect flows with the state `FT_FINISHED' (detection done). * nDPIsrvd.py: force use of JSON schema Draft 7 validator * flow-dash.py: gather/use total processed layer4 payload size * flow-info.py: added additional event filter * flow-info.py: prettified flow events printing whose detection is in progress * py-semantic-validation.py: added validation checks for FT_FINISHED * updated flow event JSON schema Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* nDPIsrvd: Fixed memory leak caused be not clearing buffer cache after a ↵Toni Uhlig2022-01-26
| | | | | | | | client disconnected. * README.md: Fixed a typ0 and added a meh image from examples/py-flow-dashboard/flow-dash.py Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* py-flow-dashboard: added tab layout and event pie chartToni Uhlig2022-01-26
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Improved Plotly/Dash example. It is now somehow informative.Toni Uhlig2022-01-25
| | | | | | | * TCP timeout after FIN/RST: switched back to the value from a35fc1d5ea8570609cc0c8cf6edadc81f8f5bb76 * py-flow-info: reset 'guessed' flag after detection/detection-update received Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Major nDPId extension. Sorry for the huge commit.Toni Uhlig2022-01-20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | - nDPId: fixed invalid IP4/IP6 tuple compare - nDPIsrvd: fixed caching issue (finally) - added tiny c example (can be used to check flow manager sanity) - c-captured: use flow_last_seen timestamp from `struct nDPIsrvd_flow` - README.md update: added example JSON sequence - nDPId: added new flow event `update` necessary for correct timeout handling (and other future use-cases) - nDPIsrvd.h and nDPIsrvd.py: switched to an instance (consists of an alias/source tuple) based flow manager - every flow related event **must** now serialize `alias`, `source`, `flow_id`, `flow_last_seen` and `flow_idle_time` to make the timeout handling and verification process work correctly - nDPIsrvd.h: ability to profile any dynamic memory (de-)allocation - nDPIsrvd.py: removed PcapPacket class (unused) - py-flow-dashboard and py-flow-multiprocess: fixed race condition - py-flow-info: print statusbar with probably useful information - nDPId/nDPIsrvd.h: switched from packet-flow only timestamps (`pkt_*sec`) to a generic flow event timestamp `ts_msec` - nDPId-test: added additional checks - nDPId: increased ICMP flow timeout - nDPId: using event based i/o if capturing packets from a device - nDPIsrvd: fixed memory leak on shutdown if remote descriptors were still connected Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Removed py-flow-undetected-to-pcap and py-risky-flow-to-pcap. Done by ↵Toni Uhlig2021-11-21
| | | | | | c-captured anyway. Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* go-dashboard renaming, ignore go-mod and it's file structureToni Uhlig2021-11-21
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added timestamp validation test.Toni Uhlig2021-11-02
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Additional semantic validation tests.Toni Uhlig2021-11-02
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* c-captured: Improved format string in nDPIsrvd_write_flow_info_cb.Toni Uhlig2021-10-08
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fixed compile error due to missing stdint.h include before ndpi_typedefs.hToni Uhlig2021-10-08
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added support/debug function to write flow(-user) related info.Toni Uhlig2021-10-08
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* bump libnDPI to 6b7e5fa8d251f11c1bae16ea892a43a92b098480Toni Uhlig2021-08-03
| | | | | | | | * fixed linking issue by using CMake to check if explicit link against libm required * make nDPIsrvd collectd exit if parent pid changed, meaning that collectd died somehow * nDPId-test restores SIGPIPE to the default handler (termination), so abnormal connection drop's do now have consequences Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Build JSMN with support for parent links.Toni Uhlig2021-07-13
| | | | | | | * nDPIsrvd.h: iterate over subtokens * nDPIsrvd-captured: select/ unselect risky flows to capture Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Unified IO buffer mgmt.Toni Uhlig2021-06-07
| | | | | | | * c-collectd gives the user control over collectd-exec instance name * added missing collectd type `flow_l4_icmp_count` Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* flow-dash: Simplified and extended bar graph.Toni Uhlig2021-05-28
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* flow-dash: Added live bars visualising midstream/risky flow count.Toni Uhlig2021-05-28
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added realtime web based graph example using Plotly/Dash.Toni Uhlig2021-05-27
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added simple Python Multiprocess example.Toni Uhlig2021-05-26
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* nDPIsrvd-captured: skip empty flows based on flow total payload lengthToni Uhlig2021-05-20
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Reworked layer 4 flow length naming/calculation.Toni Uhlig2021-05-20
| | | | | | | * nDPIsrvd services usually do not care about layer4 data length, payload length is quite more essential for further processing Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Fixed CMake global CFLAGS misuse which can cause xcompile errors.Toni Uhlig2021-05-19
| | | | | | | | | | nDPIsrvd-captured supports skipping flows w/o any layer 4 payload. * libndpi update * run_tests does not generate any *.out files for fuzz-*.pcap anymore and does not fail if nDPId-test exits with value 1 (most likely caused by a libpcap failure) Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* py-flow-info: Support for --ipwhois, --new and --detection.Toni Uhlig2021-04-30
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added JA3 blacklist downloader/checker from abuse.chToni Uhlig2021-04-17
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
* Added python example to check JA3 hashes against known hashes via JA3er.comToni Uhlig2021-04-16
| | | | Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Powered by cgit, Themed by Ted Yin.