wssxsxxsx
8894ebc76f
Add Automatic Tank Gauge protocol ( #2527 )
...
See also #2523
---------
Co-authored-by: Nardi Ivan <nardi.ivan@gmail.com>
2024-08-23 22:35:08 +02:00
Vladimir Gavrilov
a10c48c80a
Add CNP/IP protocol support ( #2521 )
...
ISO/IEC 14908-4 defines how to tunnel Control Network Protocol (CNP) over IP networks. It encapsulates protocols like EIA-709, EIA-600, and CNP, making it a versatile solution for building automation and control systems.
2024-08-22 15:26:32 +02:00
Nardi Ivan
5d33312be7
Sync unit tests results
2024-08-07 11:56:16 +02:00
Luca Deri
fc4fb4d409
Fixed probing attempt risk that was creating false positives
2024-08-07 11:38:41 +02:00
Ivan Nardi
2740a4f4e3
Update all IP lists ( #2515 )
...
The `suffix_id` is simply an incremental index (see
`ndpi_load_domain_suffixes`), so its value might changes every time we
update the public suffix list.
2024-08-02 15:06:08 +02:00
Luca Deri
f3ea8ca6be
Improved ICMP malformed packet risk description
2024-07-25 12:54:59 +02:00
Ivan Nardi
85501c9aaa
FPC: add DPI information ( #2514 )
...
If the flow is classified (via DPI) after the first packet, we should
use this information as FPC
2024-07-23 08:50:27 +02:00
Vladimir Gavrilov
b15337a32b
Add OpenWire support ( #2513 )
2024-07-22 19:20:44 +02:00
Ivan Nardi
65e31b0ea3
FPC: small improvements ( #2512 )
...
Add printing of fpc_dns statistics and add a general cconfiguration option.
Rework the code to be more generic and ready to handle other logics.
2024-07-22 17:42:23 +02:00
mmanoj
67f5cdafc0
FPC: add DNS correlation ( #2497 )
...
Use DNS information to get a better First Packet Classification.
See: #2322
---------
Co-authored-by: Nardi Ivan <nardi.ivan@gmail.com>
2024-07-22 11:34:07 +02:00
Vladimir Gavrilov
6a77a891a8
Add Nano (XNO) protocol support ( #2508 )
2024-07-18 16:18:12 +02:00
Luca
86b67e6687
Added ClickHouse protocol
2024-07-17 14:21:45 +02:00
Vladimir Gavrilov
c3fff52646
Add HLS support ( #2502 )
2024-07-16 12:01:28 +02:00
Ivan Nardi
c3ba65311e
fuzzing: improve coverage ( #2495 )
...
Fix detection of WebDAV and Gnutella (over HTTP)
Fix detection of z3950
Add two fuzzers to test `ndpi_memmem()` and `ndpi_strnstr()`
Remove some dead code:
* RTP: the same exact check is performed at the very beginning of the
function
* MQTT: use a better helper to exclude the protocol
* Colletd: `ndpi_hostname_sni_set()` never fails
Update pl7m code (fix a Use-of-uninitialized-value error)
2024-07-12 14:22:25 +02:00
Ivan Nardi
456f0fd427
Improve detection of Cloudflare WARP traffic ( #2491 )
...
See: #2484
2024-07-04 08:59:04 +02:00
Ivan Nardi
843e487270
Add infrastructure for explicit support of Fist Packet Classification ( #2488 )
...
Let's start with some basic helpers and with FPC based on flow addresses.
See: #2322
2024-07-03 18:02:07 +02:00
Ivan Nardi
1e411e98fa
Reduce snaplen of some traces ( #2490 )
...
To avoid the following error with some old libpcap versions:
```
ERROR: could not open pcap file: invalid file capture length 524288, bigger than maximum of 262144
```
2024-07-03 16:17:08 +02:00
Ivan Nardi
fc334d56c4
tunnelbear: improve detection over wireguard ( #2485 )
...
See #2484
2024-07-01 08:20:18 +02:00
Ivan Nardi
4f05d21441
Improve detection of Twitter/X ( #2482 )
2024-07-01 08:20:04 +02:00
Ivan Nardi
26cc1f131f
fuzz: improve fuzzing coverage ( #2474 )
...
Remove some code never triggered
AFP: the removed check is included in the following one
MQTT: fix flags extraction
2024-06-17 13:45:47 +02:00
Nardi Ivan
a35fae6b75
Sync unit tests results
2024-06-17 11:23:39 +02:00
Toni
8fd649ab1e
Add Ripe Atlas probe protocol. ( #2473 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-06-17 11:00:38 +02:00
Nardi Ivan
bbe52da5cf
Zoom: harden RTP/RTCP detection
2024-06-17 10:19:55 +02:00
Nardi Ivan
526cf6f291
Zoom: remove "stun_zoom" LRU cache
...
Since 070a0908b
2024-06-17 10:19:55 +02:00
Mark Jeffery
f796c94375
Added protocol - JRMI - Java Remote Method Invocation ( #2470 )
2024-06-15 10:52:28 +02:00
Luca
7c7c375b45
Improved detection of Android connectiity checks
2024-06-12 10:55:07 +02:00
Ivan Nardi
070a0908b3
Zoom: faster detection of P2P flows ( #2467 )
2024-06-07 09:50:41 +02:00
Ivan Nardi
619005c5b2
STUN: add support for Microsoft Multiplexed TURN channels ( #2464 )
2024-06-05 16:55:58 +02:00
Ivan Nardi
7be482f5b1
Update unit tests results ( #2466 )
2024-06-05 11:55:30 +02:00
Ivan Nardi
81e42b748e
RTP: fix detection over TCP ( #2462 )
...
RFC4571 is not the only way to wrap RTP messages in TCP streams.
For example, when RTP is encapsulated over TURN flows (i.e. via DATA
attribute) there is no additional framing.
See also 6127e0490
2024-05-29 18:31:10 +02:00
Maatuq
6127e04900
support rtp/rtcp over tcp ( #2422 ) ( #2457 )
...
Support rtp/rtcp over tcp as per rfc4571.
Signed-off-by: mmaatuq <mahmoudmatook.mm@gmail.com>
2024-05-28 22:01:08 +02:00
Toni
80171dbcf3
Add ZUG consensus protocol dissector. ( #2458 )
...
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
2024-05-28 20:29:48 +02:00
Ivan Nardi
25f8964a23
CiscoVPN: we detect it only over UDP ( #2454 )
...
The original code handled also TCP/TLS, but it was removed in 6fc29b3ae
2024-05-28 14:07:48 +02:00
Toni
abce6d4023
Improved Kafka dissector. ( #2456 )
...
* detect more Kafka request packet's
* requires less flow memory
* same detection behavior as before e.g. no asym detection implemented
(can be done by dissecting responses, requires more effort)
Signed-off-by: Toni Uhlig <matzeton@googlemail.com>
Co-authored-by: Nardi Ivan <nardi.ivan@gmail.com>
2024-05-27 09:46:32 +02:00
Vladimir Gavrilov
d1a59c0308
Rename Messenger to FacebookMessenger ( #2453 )
2024-05-23 09:23:31 +02:00
Nardi Ivan
521ce609c8
Sync unit tests results
2024-05-22 19:00:33 +02:00
Luca
44a290286b
More NDPI_PROBING_ATTEMPT changes
2024-05-22 18:04:33 +02:00
Luca
74d3843ebe
Added NDPI_PROBING_ATTEMPT risk
2024-05-22 17:55:16 +02:00
Ivan Nardi
fd02baa13a
DTLS: fix JA4 fingerprint ( #2446 )
2024-05-21 18:13:25 +02:00
Ivan Nardi
83840f1bb9
DTLS: add support for DTLS 1.3 ( #2445 )
2024-05-21 12:49:27 +02:00
Ivan Nardi
0109014f2c
Follow-up of 2093ac5bf ( #2451 )
2024-05-21 12:47:25 +02:00
Luca Deri
2093ac5bf6
Minor dissector optimizations
2024-05-20 12:17:04 +02:00
Vladimir Gavrilov
3d1da00d8d
Add Call of Duty Mobile support ( #2438 )
2024-05-15 12:46:02 +02:00
Ivan Nardi
0110623b4e
H323: improve detection and avoid false positives ( #2432 )
2024-05-11 23:39:54 +02:00
Vladimir Gavrilov
2d33431948
Add Ethernet Global Data support ( #2437 )
2024-05-11 16:49:16 +02:00
Vladimir Gavrilov
70c4920184
Remove Vevo support ( #2436 )
...
Co-authored-by: Ivan Nardi <12729895+IvanNardi@users.noreply.github.com>
2024-05-11 11:57:53 +02:00
Ivan Nardi
b116456fc5
Viber: add detection of voip calls and avoid false positives ( #2434 )
2024-05-11 09:21:13 +02:00
Ivan Nardi
4b4b358562
Line: use common helper to detect RTP/RTCP packets ( #2429 )
...
Add an explicit upper limit on the number of packets processed before
giving up.
2024-05-10 19:23:50 +02:00
Ivan Nardi
d4650f0f81
Raknet/RTP: avoid Raknet false positives and harden RTP heuristic ( #2427 )
...
There is some overlap between RTP and Raknet detection: give precedence
to RTP logic.
Consequences:
* Raknet might require a little bit more packets for some flows (not a
big issue)
* some very small (1-2 pkts) Raknet flows are not classified (not sure
what do do about that..)
2024-05-09 21:18:18 +02:00
Ivan Nardi
2e7fc82e55
Protobuf: fix false positives ( #2428 )
2024-05-09 15:38:06 +02:00
